CVE detail
CVE-2026-0846
A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 19.5 · diversity 13.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
6 source links · newest first
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0846.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comMar 9, 2026, 8:16 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2445826bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMar 9, 2026, 8:16 PM - https://access.redhat.com/security/cve/CVE-2026-0846access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 9, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:19712access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 9, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:10184access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 9, 2026, 8:16 PM No excerpt available.
Exploithuntr.comMar 9, 2026, 8:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-49290CVSS 7.6 · High
Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal vulnerability in Slo…
- CVE-2026-32175CVSS 4.3 · Medium
A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files a…
- CVE-2026-42315CVSS 8.1 · High
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the dat…
- CVE-2026-7217CVSS 5.5 · Medium
A security vulnerability has been detected in Deepractice PromptX up to 2.4.0. The affected element is the function read_docx/read_xlsx/read_pptx/list_xlsx_sheets/read_pdf of the…
- CVE-2026-28414CVSS 7.5 · High
Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path tr…
- CVE-2026-27117CVSS 5.5 · Medium
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.11, a path traversal vulnerability ("Zip Slip") exists i…