Description

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-22T15:16:21.100Z",
  "pubdate": "2026-08-22T15:16:21.100Z",
  "executiveSummary": "NLTK versions prior to 3.9.4 are affected by a symlink escape vulnerability residing within the CorpusReader.open() method, allowing local attackers to read arbitrary files outside the designated corpus root.\nThis vulnerability stems from insufficient path validation that relies strictly on lexical analysis rather than resolving symbolic links during path traversal checks.\nThe security impact involves unauthorized access to sensitive local files that the process owner has read permissions for, bypassing intended boundary restrictions enforced by the application.\nThe risk implication is moderate to high depending on the deployment context, particularly in shared hosting or multi-tenant environments where local file inclusion or information disclosure poses severe confidentiality risks.\nAn attacker must possess local execution capabilities or the ability to manipulate data within the corpus root to successfully position malicious symlinks.\nExploitation requirements include local access to create symlinks pointing to targeted external file paths, which are subsequently resolved when NLTK processes corpus read operations.",
  "technicalDetails": "The vulnerability exists within the CorpusReader.open() function of the NLTK library, specifically affecting versions prior to 3.9.4.\nThe root cause of the vulnerability is flawed path validation logic that performs purely lexical checks on input paths without accounting for actual filesystem-level symlink resolution.\nBecause path validation occurs strictly at the lexical level, an attacker can create symbolic links inside the corpus root that point to sensitive files located outside the intended boundary directory.\nWhen CorpusReader.open() processes file access requests, it follows the symlinked paths because the underlying operating system resolves them during file I/O operations.\nThe attack flow proceeds as follows: first, the local attacker places a symbolic link inside the corpus root pointing to an arbitrary target file outside the sandbox boundary, such as /etc/passwd or application configuration files.\nSecond, the attacker invokes or triggers an NLTK corpus reading operation that utilizes CorpusReader.open() to access the crafted symlink path.\nThird, the application reads the referenced file via the resolved symlink, effectively bypassing the lexical boundary checks.\nFinally, the contents of the arbitrary file are returned or processed through the NLTK interface, leading to unauthorized information disclosure.\nThe vulnerability requires local access to the filesystem to plant the symlink, but does not inherently require authentication or high privileges beyond those needed to write within the corpus directory and read the target files.\nNetwork exposure is not a direct vector unless combined with an upstream interface that allows untrusted users to upload or create files within the corpus root."
}