CVE-2026-62383: nltk IPIPANCorpusReader Symlink Arbitrary File Read
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nltk IPIPANCorpusReaderto a version that resolves this vulnerability.Fixed in 3.10.2
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker must be able to place a symlink in the corpus root directory. The vulnerable process must then call channels(), domains(), categories(), or fileids() with the symlink filename.
Which deployments are realistically exposed?
Deployments are exposed when an untrusted party can create or control symlinks in an NLTK IPIPAN corpus root and can cause the affected reader methods to process those filenames. The attacker can read files that are accessible to the running process.
How can I determine whether my installation is affected?
NLTK versions before 3.10.2 are affected. Review IPIPAN corpus root directories for symlinks and determine whether application code calls channels(), domains(), categories(), or fileids() using filenames that could refer to those links.