Gptline: NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure (CVE-2026-71514)

NLTK versions 3.9.4 through 3.10.2 have a path traversal vulnerability (CVE-2026-71514) in CrubadanCorpusReader. The function _load_lang_ngrams constructs file paths by joining the corpus root with a language code read from a mapping file, but it uses the builtin open() without pathsec validation. This allows an absolute path in the language code to bypass the corpus root containment check, enabling disclosure of files outside the corpus directory. The vulnerability is constrained to files ending with '-3grams.txt' whose contents parse as token count lines. An attacker controlling a corpus package can exploit this to read arbitrary files.

An attacker who can supply or control a corpus package can read arbitrary files outside the corpus root directory, limited to those matching the '-3grams.txt' suffix and token count format. The impact is confidentiality loss of file contents. There is no indication of integrity or availability impact. The CVSS score of 2.5 (low) reflects the limited scope and required attacker capabilities.

A patch is available for this vulnerability. Users should upgrade NLTK to a fixed version beyond 3.10.2. No additional mitigation steps are indicated in the advisory.