CVE-2026-0847: 
Python vulnerability analysis and mitigation

CVE-2026-0847 is a path traversal vulnerability (CWE-22) in the Natural Language Toolkit (NLTK) library that allows unauthenticated remote attackers to read arbitrary files on the server. It affects NLTK versions up to and including 3.9.2, impacting multiple CorpusReader classes: WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. The vulnerability was published on March 4, 2026, and assigned by huntr.ai. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, huntr.com).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22): the affected CorpusReader classes in NLTK fail to sanitize or validate user-supplied file paths before using them in file system operations. An attacker who can influence the file path argument passed to these classes — for example, via a machine learning API, chatbot backend, or NLP pipeline that accepts user-controlled corpus paths — can supply traversal sequences (e.g., ../../etc/passwd) to escape the intended directory and read arbitrary files. No authentication or special privileges are required, and the attack complexity is low. A public PoC and bounty write-up are available on huntr.com (huntr.com, The Hacker Wire).

Successful exploitation allows an unauthenticated attacker to read arbitrary files from the server's file system, with a high confidentiality impact and no direct integrity or availability impact. Sensitive targets include system files (e.g., /etc/passwd, /etc/shadow), SSH private keys, API tokens, and application configuration files. In environments where NLTK is embedded in AI/ML APIs or NLP pipelines, this can expose credentials that enable lateral movement or privilege escalation, and the vulnerability description notes potential escalation to remote code execution when chained with other weaknesses (huntr.com, Red Hat CVE).

A public PoC exploit is available via the huntr.com bounty disclosure and a GitHub repository (HyperPS/CVE-2026-0847), and exploit references have appeared on Sploitus (PacketStorm IDs 218143 and 219788) (huntr.com). The EPSS score is approximately 0.249%, indicating a relatively low but non-negligible probability of exploitation in the wild. No CISA KEV catalog listing or confirmed in-the-wild exploitation by named threat actors has been reported at this time. The vulnerability is detectable by Nessus (plugin IDs 301115, 316734) and Qualys (ID 6035704).

1. Reconnaissance: Identify applications or APIs that use NLTK ≤ 3.9.2 and accept user-controlled file path inputs for corpus loading (e.g., NLP APIs, chatbot backends, ML pipelines).
2. Identify vulnerable endpoint: Locate the application endpoint or function that invokes a vulnerable CorpusReader class (WordListCorpusReader, TaggedCorpusReader, or BracketParseCorpusReader) with a user-supplied path parameter.
3. Craft traversal payload: Construct a path traversal string such as ../../../../etc/passwd or ../../../../home/user/.ssh/id_rsa as the corpus file path argument.
4. Submit malicious input: Send the crafted payload to the vulnerable endpoint (e.g., via HTTP request parameter, API call, or direct function invocation if the attacker has code-level access).
5. Read arbitrary file: The CorpusReader class, lacking path sanitization, opens and returns the contents of the targeted file, exposing sensitive data to the attacker (huntr.com, The Hacker Wire).

• Network: Unusual HTTP requests to NLP/ML API endpoints containing path traversal sequences (e.g., ../, %2e%2e%2f, ..%2f) in file path parameters; unexpected outbound data transfers from servers running NLTK-based applications.
• Logs: Application or web server logs showing requests with corpus path parameters containing ../ sequences or references to sensitive system paths (e.g., /etc/passwd, /.ssh/); error messages from NLTK CorpusReader classes referencing unexpected file paths.
• File System: No direct file system artifacts from read-only exploitation; however, if chained with RCE, look for new files or scripts in writable directories accessible by the application service account.
• Process: Unusual file read operations by the Python process running NLTK, particularly reads of files outside the expected corpus directories (detectable via auditd or similar file access monitoring).

Users should upgrade NLTK to a version beyond 3.9.2 that includes a fix for this path traversal issue; the patch details reference the huntr.com bounty disclosure dated April 27, 2026 (huntr.com). IBM has issued advisories for affected products including QRadar Suite Software and watsonx Orchestrate with watsonx Assistant Cartridge, and users of those products should apply the respective IBM security updates (IBM QRadar Advisory, IBM watsonx Advisory). As a workaround where upgrading is not immediately possible, applications should strictly validate and sanitize all user-supplied file paths before passing them to NLTK CorpusReader classes, using allowlists of permitted directories and rejecting any input containing traversal sequences. OpenSUSE and Mageia have also released updated packages for their distributions (openSUSE Advisory).

The vulnerability received coverage from The Hacker Wire, which highlighted the path traversal risk in NLTK's CorpusReader classes (The Hacker Wire). Security community discussion appeared on Mastodon and Bluesky shortly after the CVE was published. Linux distribution maintainers (openSUSE, Mageia, Ubuntu) responded promptly with security update advisories. IBM issued formal security bulletins for its enterprise products that bundle NLTK, reflecting the library's broad downstream impact in AI/ML product stacks (IBM QRadar Advisory, IBM watsonx Advisory).