CVE-2026-0846

{"id": "CVE-2026-0846", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2026-03-09T20:16:05.703", "references": [{"url": "https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb", "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-36"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n `filestring()` del m\u00f3dulo `nltk.util` en la versi\u00f3n 3.9.2 de nltk permite la lectura arbitraria de archivos debido a una validaci\u00f3n inadecuada de las rutas de entrada. La funci\u00f3n abre directamente archivos especificados por la entrada del usuario sin sanitizaci\u00f3n, lo que permite a los atacantes acceder a archivos sensibles del sistema al proporcionar rutas absolutas o rutas de recorrido. Esta vulnerabilidad puede ser explotada local o remotamente, particularmente en escenarios donde la funci\u00f3n se utiliza en APIs web u otras interfaces que aceptan entrada proporcionada por el usuario."}], "lastModified": "2026-03-12T15:16:12.590", "sourceIdentifier": "security@huntr.dev"}