---
id: CVE-2026-70626
title: >-
  NLTK versions before 3.9.4 contain a symlink escape vulnerability in
  CorpusReader.open() that allows local attackers to read arbitrary files
  outside the corpus root
summary: >-
  NLTK versions before 3.9.4 contain a symlink escape vulnerability in
  CorpusReader.open() that allows local attackers to read arbitrary files
  outside the corpus root. The vulnerability exists because path validation is
  lexical and does no…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-59
  - CWE-22
vendor: nltk
product: nltk
affected:
  - nltk < 3.9.4
patched:
  - nltk 3.9.4
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70626'
references:
  - url: 'https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nltk-before-symlink-escape-via-corpusreader
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70626'
  - url: 'https://github.com/nltk/nltk/pull/3522'
  - url: >-
      https://github.com/nltk/nltk/commit/1b0e519e2324bc1a273d56edee63e44d0ad85b48
  - url: 'https://github.com/nltk/nltk/releases/tag/3.9.4'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3732.yaml
  - url: 'https://github.com/advisories/GHSA-r6gq-whwq-mvg9'
  - url: 'https://github.com/nltk/nltk'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70626.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-70626'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2521338'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-70626'
tags:
  - nvd
  - ghsa
  - pip
  - osv
  - csaf
  - vex
  - red-hat
epss: 0.002
epssPercentile: 0.09701
aliases:
  - GHSA-r6gq-whwq-mvg9
  - PYSEC-2026-3732
ecosystem: pip
ingestedAt: '2026-08-23T04:42:15.619Z'
---

## Overview

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.

## Affected

- `nltk < 3.9.4`

## Remediation

Upgrade past the affected range:

- `nltk 3.9.4`

## Package advisory (CVE-2026-70626)

Affected packages:

- `nltk <= 3.9.3`

Patched in:

- `nltk 3.9.4`

Source: https://github.com/advisories/GHSA-r6gq-whwq-mvg9

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70626.json)