このページは Ubuntu 向けの修正状況です。脆弱性そのものの説明は CVE 本体のページにあります。
CVE-2026-70626 の詳細 →
UBUNTU-CVE-2026-70626
NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside t...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.
出典: OSV.dev (Open Source Vulnerabilities) OSV
影響パッケージ
Ubuntu:Pro:14.04:LTS
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:22.04:LTS
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:24.04:LTS
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:26.04:LTS
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
参照URL
- report ubuntu.com
- report cve.org
- report github.com
- report security-tracker.debian.org
- report github.com
- report nvd.nist.gov
- report vulncheck.com