Fluid Attacks Database

Description

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1 \|\| >=0 <3.10.3-1	3.10.3-1
debian 12	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 13	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 11	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.5-1 \|\| =3.6.5-1 \|\| =3.6.7-1 \|\| =3.7-1 \|\| =3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
pypi	nltk	=3.10.0 \|\| =3.10.1 \|\| >=3.10.0 <3.10.2	3.10.2

Aliases

1. CVE-2026-623832. NVD-2026-623833. OSV-DEBIAN-2026-623834. OSV-2026-623835. OSV-PYSEC-2026-37266. GCVE-2026-623837. SECURITY-TRACKER-CVE-2026-623838. vulncheck.com

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.