CVE-2026-65915

MediumCVSS 6.5/10Last modified Oct 14, 2026

Description

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-659168.1CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that a CVE-2026-659178.8CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups appli CVE-2026-659187.1PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_fro CVE-2026-659197.5Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload CVE-2026-65923.5A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_mana CVE-2026-659204.3Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that CVE-2026-659218.8A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended b CVE-2026-659225.4An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to rest CVE-2026-659236.8A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, CVE-2026-659246.5JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authentica CVE-2026-659256.5A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.CVE-2026-659263.1An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and vers