CVE-2026-62385
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Aug 22, 2026
Vendor
unknown
Description
NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application.