REDHAT-BUG-2445826: High severity nltk nltk.util (filestring) vulnerability

Published Mar 9, 2026

Updated

A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

Affected Software

1 affected component

nltk nltk.util (filestring)=3.9.2

Event History

Mar 9, 2026

Data Sourced

via Red Hat·08:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2445826?

The severity of REDHAT-BUG-2445826 is classified as high with a score of 7.

What does REDHAT-BUG-2445826 affect?

REDHAT-BUG-2445826 affects the `filestring()` function in the `nltk.util` module of nltk version 3.9.2.

How do I fix REDHAT-BUG-2445826?

To fix REDHAT-BUG-2445826, update to a patched version of nltk that addresses the input validation issue.

What kind of security risk does REDHAT-BUG-2445826 pose?

REDHAT-BUG-2445826 poses a risk of arbitrary file read which can lead to unauthorized access to sensitive system files.

In which version of NLTK is REDHAT-BUG-2445826 found?

REDHAT-BUG-2445826 is found in nltk version 3.9.2.