Description

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-22T15:16:17.883Z",
  "pubdate": "2026-08-22T15:16:17.883Z",
  "executiveSummary": "A symlink-based arbitrary file read vulnerability exists in the IPIPANCorpusReader methods within Natural Language Toolkit (nltk) versions before 3.10.2.\nThe vulnerability allows malicious actors to completely bypass nltk.pathsec validation mechanisms.\nSuccessful exploitation enables unauthorized readers to read arbitrary files accessible to the running application process.\nThe affected systems include any deployment processing untrusted corpus data using vulnerable nltk versions.\nThe risk implications include potential exposure of sensitive system files, configuration data, or credentials depending on the process privileges.\nAttacker capabilities require the ability to place a symbolic link within the corpus root directory.\nExploitation is triggered when specific corpus methods are invoked with the crafted symlink filename.",
  "technicalDetails": "The root cause of the vulnerability lies in insufficient path validation and sanitization within the IPIPANCorpusReader methods of the nltk library.\nSpecifically, the methods channels(), domains(), categories(), and fileids() fail to properly validate target paths against symlink redirection, completely bypassing nltk.pathsec validation controls.\nThe vulnerable component is the IPIPANCorpusReader class and its associated corpus traversal methods handling file system interactions.\nAffected versions comprise all nltk versions prior to 3.10.2.\nThe attack flow begins when an attacker with write access, or through corpus provisioning mechanisms, places a symbolic link inside the corpus root directory pointing to an arbitrary target file on the host system.\nWhen an application processes the corpus and invokes methods such as channels(), domains(), categories(), or fileids() referencing the malicious symlink filename, the reader follows the symlink without adequate restriction.\nBecause path security checks implemented in nltk.pathsec are bypassed, the system processes the linked file as part of the corpus data structures.\nSubsequent read operations or data processing routines expose the contents of the arbitrary target file to the caller.\nAuthentication and privilege requirements depend entirely on the context in which the nltk application executes, requiring local file system access to plant the symlink and process execution privileges to read the target files.\nNetwork exposure is indirect, typically dependent on how the application ingests untrusted corpora over network interfaces or shared storage volumes.\nPost-exploitation impact involves the unauthorized disclosure of sensitive data accessible to the user ID running the Python process."
}