NLTK up to 3.9.4 nltk/data.py url2pathname path traversal 🚫 [False Positive]

Noticeinfo

⚠️ This issue looks like a false-positive. Please review the listed sources and think about not using this entry.

Productinfo

Name

• NLTK

Version

• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4

Timelineinfo

06/15/2026 CVE reserved
06/30/2026 +15 days Advisory disclosed
06/30/2026 +0 days VulDB entry created
08/18/2026 +49 days VulDB entry last update

Sourcesinfo

Advisory: huntr.com
False Positive: Yes

CVE: CVE-2026-12243 (🔒)
GCVE (CVE): GCVE-0-2026-12243
GCVE (VulDB): GCVE-100-374761
EUVD: 🔒

Entryinfo

Created: 06/30/2026 06:48
Updated: 08/18/2026 13:18
Changes: 06/30/2026 06:48 (62), 08/18/2026 11:29 (3), 08/18/2026 13:18 (1)
Complete: 🔍
Cache ID: 216::103

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion

Want to know what is going to be exploited?

We predict KEV entries!