CVE-2026-65915
CVE-2026-65915: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-65915] Arbitrary file read due to logic bug in FileSystemPathPointer
CVE-2026-65915Source published Source updated
NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files. A flaw was found in NLTK. A remote attacker can exploit this by providing specially crafted `file://` Uniform Resource Locators (URLs) to `nltk.data.load()`. This enables the attacker to read arbitrary files on the system, potentially leading to the disclosure of sensitive information such as credentials and configuration files. This could lead to information disclosure, including sensitive credentials or configuration data, within…
- Affected products in this advisory
- Exploit Intelligence
- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
1 more entries in the full advisory.
- Source-reported affected versions
- < 3.10.0
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Mitigation for this issue involves ensuring that applications utilizing the NLTK library do not process untrusted `file://` URLs through `nltk.data.load()`. Implement input validation and sanitization for any data passed to NLTK functions that could resolve file paths. Additionally, running applications that use NLTK with the principle of least privilege can limit the impact of successful exploitation by restricting access to sensitive files.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.