---
id: CVE-2026-79676
title: >-
  nltk: NLTK: Information disclosure via path traversal with symlink bypass
  (CVE-2026-79676)
summary: >-
  A flaw was found in NLTK. This path traversal vulnerability allows attackers
  to bypass security measures by using symbolic links within trusted data roots.
  By staging specially crafted symlinked corpus files, an attacker can disclose
  sensi…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe:
  - CWE-22
  - CWE-59
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - exploit_intelligence
  - lightspeed_core
  - openshift_lightspeed
  - ansible_automation_platform 2
  - openshift_ai_rhoai
patched:
  - nltk 3.10.3
published: '2026-08-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:22:54+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79676.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79676.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-79676'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2523560'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-79676'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79676'
  - url: 'https://github.com/nltk/nltk/security/advisories/GHSA-p4rw-rvv2-7xwr'
  - url: >-
      https://www.vulncheck.com/advisories/nltk-before-path-traversal-via-symlink-bypass
  - url: >-
      https://github.com/nltk/nltk/commit/10d34b3f4fe3fec74b76527a409eb0acbac2e8ab
  - url: 'https://github.com/nltk/nltk'
  - url: 'https://github.com/nltk/nltk/releases/tag/v3.10.3'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3737.yaml
  - url: 'https://github.com/advisories/GHSA-p4rw-rvv2-7xwr'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - ghsa
epss: 0.00447
epssPercentile: 0.38678
aliases:
  - GHSA-p4rw-rvv2-7xwr
  - PYSEC-2026-3737
ecosystem: pip
ingestedAt: '2026-09-02T19:31:24.475Z'
---

## Overview

A flaw was found in NLTK. This path traversal vulnerability allows attackers to bypass security measures by using symbolic links within trusted data roots. By staging specially crafted symlinked corpus files, an attacker can disclose sensitive information from outside the intended data directories. This could lead to unauthorized access to confidential data.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79676.json)

**nltk: NLTK: Information disclosure via path traversal with symlink bypass** — rated Moderate by Red Hat. Released 2026-08-25, updated 2026-10-15.

Affected:

- Exploit Intelligence
- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Exploit Intelligence
- Red Hat Ansible Automation Platform 2
- Lightspeed Core
- OpenShift Lightspeed
- Red Hat OpenShift AI (RHOAI)

## Remediation

Out of support scope

Workarounds / mitigations:

- Restrict local write permissions on NLTK data and corpus directories to prevent unauthorized staging of symlinked files, or ensure corpus file paths are validated against trusted roots before invoking corpus reader retrieval methods.

## Package advisory (CVE-2026-79676)

Affected packages:

- `nltk < 3.10.3`

Patched in:

- `nltk 3.10.3`

Source: https://osv.dev/vulnerability/GHSA-p4rw-rvv2-7xwr