Gptline: NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read (CVE-2026-63312)

The vulnerability (CVE-2026-63312) in NLTK arises because StreamBackedCorpusView._open() and related code bypass the pathsec.validate_path() enforcement when opening files, even if nltk.pathsec.ENFORCE is set to True. This allows arbitrary local file read by passing a malicious file path as the fileid parameter. The enforcement function in pathsec.py calls validate_path() before opening files, but StreamBackedCorpusView directly calls builtins.open() and os.stat() on string fileids, ignoring the sandbox. This flaw affects any corpus reader subclass that uses StreamBackedCorpusView with raw string fileids. The vulnerability is confirmed on the latest stable NLTK versions and requires no privileges.

This vulnerability enables arbitrary local file read on affected systems, bypassing the intended sandboxing controls of nltk.pathsec.ENFORCE. Attackers can read sensitive files such as /etc/passwd, /proc/self/environ (which may contain environment secrets), and application configuration files. This represents a broken access control issue (OWASP A01:2021) and CWE-22 (Path Traversal) and CWE-284 (Improper Access Control). It affects web applications, REST APIs, and multi-tenant NLP pipelines that pass user-controlled input to NLTK corpus readers, potentially exposing sensitive data without requiring any privileges.

A patch is available for this vulnerability. The recommended fix is to modify StreamBackedCorpusView and related corpus readers to replace direct calls to builtins.open() and os.stat() with calls to nltk.pathsec.open() and nltk.pathsec.validate_path(), ensuring enforcement of the sandbox. Operators should apply the official patch or update to a fixed version as soon as possible. Until patched, avoid passing untrusted user input directly as fileid to corpus readers that use StreamBackedCorpusView.