THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-71514 (LOW 2.5) — NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the path

[NVD] CVE-2026-71514 (LOW 2.5) — NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the path

mednvdPublished 2026-08-22

CVE-2026-71514 CVSS: 2.5 LOW Published: 2026-08-22T14:16:33.560

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join discards the root

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-71514