The vulnerability in NLTK before version 3.10.0 exists because StreamBackedCorpusView bypasses the pathsec.ENFORCE restriction by calling the built-in open() function directly rather than using pathsec.open(). This allows an attacker controlling the fileid parameter to read arbitrary local files on the system, circumventing intended path security controls. The CVSS 3.1 score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No patch or official remediation details are provided in the available data.

An unauthenticated attacker can read arbitrary local files on a system running vulnerable NLTK versions, potentially exposing sensitive system files and application credentials. This compromises confidentiality but does not affect integrity or availability. The vulnerability can be exploited remotely without user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted input for the fileid argument in StreamBackedCorpusView or apply manual code review and restrictions to prevent arbitrary file access.