The vulnerability involves path traversal and symlink boundary bypass in several NLTK corpus readers (ipipan, crubadan, lin, and others). These readers derive file paths from trusted corpus roots but then reopen them using Python's built-in open() instead of nltk.pathsec.open(), which enforces trusted-root boundaries. This allows symlinks placed inside the trusted root to point outside it and have their contents read and returned by public corpus-reader methods, defeating the intended sandboxing. The issue was reproduced in NLTK versions 3.9.4 and 3.10.0-rc2. The root cause is the failure to preserve PathPointer and required_root semantics when reopening files. The fix involves calling nltk.pathsec.validate_path with required_root scoping before opening files, ensuring escapes outside the trusted root are blocked. The patch has been applied after a full codebase audit, and tests confirm the vulnerability is mitigated.

An attacker who can place or influence corpus files or symlinks inside a trusted NLTK data root can cause corpus readers to disclose file contents from outside the trusted root directory. This breaks the security boundary intended to isolate trusted corpus data from untrusted or sensitive files elsewhere on the filesystem. The exposure occurs through normal corpus-reader API methods, potentially leaking sensitive information.

A patch is available that enforces path validation and preserves the trusted-root boundary by replacing raw open() calls with nltk.pathsec.open() or equivalent helpers that validate paths with required_root scoping. Users should upgrade to the patched versions of NLTK corpus readers once available. Until patched, avoid processing attacker-controlled corpora or symlinks inside trusted corpus roots. The vendor advisory confirms the fix and recommends applying it to all corpus readers to prevent symlink escapes.