Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-0846 Arbitrary File Read Vulnerability in NLTK 3.9.2 via Unsanitized `filestring()` Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-0846
Post summary
A brief disclosure of an arbitrary file read vulnerability in NLTK 3.9.2, mentioning the unsanitized `filestring()` function, with no PoC, exploit, or patch details.
CVE-2026-0846 A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The… https://www.cve.org/CVERecord?id=CVE-2026-0846
Post summary
The tweet announces CVE-2026‑0846, a vulnerability in NLTK 3.9.2’s `filestring()` function that permits arbitrary file reads because of inadequate input path validation.
[CVE-2026-0846: HIGH] Critical vulnerability in nltk version 3.9.2 discovered! The `filestring()` function allows arbitrary file read due to improper validation, risking system files exposure to attackers.#cve,CVE-2026-0846,#cybersecurity https://cvefind.com/CVE-2026-0846
Post summary
The post discloses a critical CVE-2026-0846 in nltk 3.9.2 that permits arbitrary file reads, but does not provide a PoC, exploit, or mitigation details.
🟠 CVE-2026-0846 - High A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens... https://www.thehackerwire.com/vulnerability/CVE-2026-0846/ https://t.co/a34giQ1ddY
Post summary
The post announces a high‑severity bug, CVE-2026‑0846, in the nltk.util.filestring() function that permits arbitrary file reads because of missing path validation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nltk | nltk | 3.9.2 | - | - |