Medium [CVE-2026-65915] Arbitrary file read due to logic bug in FileSystemPathPointer
This medium-severity Red Hat Linux advisory covers CVE-2026-65915 affecting Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.
A flaw was found in NLTK. A remote attacker can exploit this by providing specially crafted `file://` Uniform Resource Locators (URLs) to `nltk.data.load()`.
This enables the attacker to read arbitrary files on the system, potentially leading to the disclosure of sensitive information such as credentials and configuration files.
This could lead to information disclosure, including sensitive credentials or configuration data, within affected Red Hat products such as Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform, and Red Hat OpenShift AI. Exploitation requires the application to process untrusted input that can be interpreted as a `file://` URL by NLTK.
Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22.
Red Hat lists OpenShift Lightspeed as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Exploit Intelligence; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI).
- < 3.10.0
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Mitigation for this issue involves ensuring that applications utilizing the NLTK library do not process untrusted `file://` URLs through `nltk.data.load()`. Implement input validation and sanitization for any data passed to NLTK functions that could resolve file paths. Additionally, running applications that use NLTK with the principle of least privilege can limit the impact of successful exploitation by restricting access to sensitive files.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.