NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who controls a corpus package can disclose file contents outside the corpus root through lang_freq, limited to paths ending in -3grams.txt whose contents parse as token count lines.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader.
    _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus
    table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated
    opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus
    directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who controls
    a corpus package can disclose file contents outside the corpus root through lang_freq, limited to paths
    ending in -3grams.txt whose contents parse as token count lines. (CVE-2026-71514)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader.
    _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus     table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated     opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus     directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who controls     a corpus package can disclose file contents outside the corpus root through lang_freq, limited to paths     ending in -3grams.txt whose contents parse as token count lines. (CVE-2026-71514)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461343	Echo: nltk: security update to 3.10.3	Tenable Cloud Security	Echo Local Security Checks	Local	low
461343	Echo: nltk: security update to 3.10.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
339014	Linux Distros Unpatched Vulnerability : CVE-2026-71514	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-71514

low

Tenable Plugins

low

low

low