Description

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-22T15:16:18.700Z",
  "pubdate": "2026-08-22T15:16:18.700Z",
  "executiveSummary": "A symlink-based sandbox bypass vulnerability exists in the NLTK package within the FramenetCorpusReader component. The flaw allows unauthenticated local or remote attackers, depending on corpus ingestion vectors, to bypass intended path validation restrictions and read arbitrary XML files located outside the designated corpus root directory. The vulnerability stems from insufficient validation of symbolic links placed inside corpus subdirectories during file resolution operations. Successful exploitation results in unauthorized disclosure of sensitive data accessible to the application process, potentially leading to information leakage or system compromise. Affected systems include NLTK versions prior to 3.10.2. Remediation requires upgrading NLTK to version 3.10.2 or later, where path validation mechanisms are properly hardened against symbolic link traversal.",
  "technicalDetails": "The vulnerability resides in the FramenetCorpusReader component of the Natural Language Toolkit (NLTK) in versions before 3.10.2. The root cause is an improper path validation guard that fails to account for symbolic links when resolving file paths within the corpus directory structure. Specifically, methods such as frame_by_name(), _lu_file(), and doc() process XML files based on relative paths supplied or resolved within the corpus.\nAttackers can exploit this flaw by placing symbolic links with names that contain no path separators inside a corpus subdirectory. Because the filename validation logic only checks for standard path separation characters to prevent directory traversal, these symbolic links successfully pass the initial path validation guard.\nThe attack flow proceeds as follows: First, an attacker provisions a malicious symbolic link within a readable corpus subdirectory pointing to an arbitrary target file outside the corpus root. Second, the application invokes methods like frame_by_name(), _lu_file(), or doc() referencing the symbolic link. Third, the underlying file resolution mechanism follows the symbolic link during the read operation rather than restricting access to the logical sandbox. Finally, the contents of the arbitrary XML file are read and processed by the application, returning sensitive data to the caller.\nThe vulnerable component is the FramenetCorpusReader class within NLTK. Exploitation requires the ability to place symbolic links within a corpus directory processed by the reader or supply a manipulated corpus structure. Network exposure and privilege requirements depend on how the application ingests and processes untrusted corpora, but the vulnerability fundamentally enables arbitrary file read capabilities within the security context of the running application process."
}