Gptline: NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely (CVE-2026-62383)

The IPIPANCorpusReader in NLTK exposes methods (channels(), domains(), categories(), fileids()) that accept user-supplied file IDs and open files using Python's builtin open() without invoking nltk.pathsec validation. This allows a symlink placed inside the corpus root with a benign name to bypass traversal checks and read arbitrary files anywhere accessible by the process. The vulnerability is a variant of CWE-22 (path traversal) exploiting symlink resolution, distinct from prior fixes that enforced pathsec validation. The issue arises because PathPointer objects are converted to plain strings before opening, skipping validation. Proof-of-concept code demonstrates reading a file outside the corpus root via a symlink named 'evil_link.xml'. The CVSS 3.1 score is 5.5 (medium severity) with local attack vector and high confidentiality impact. The recommended fix is to route file opening through nltk.pathsec.validate_path() or CorpusReader.open() to enforce corpus root constraints.

An attacker with local write access to the corpus directory can create symlinks that cause the IPIPANCorpusReader to read arbitrary files outside the intended corpus root. This leads to unauthorized disclosure of sensitive files accessible by the process. There is no impact on integrity or availability, and no elevated privileges are required beyond the ability to place symlinks locally. The vulnerability does not require user interaction and executes with the same privileges as the running process.

A patch is available to fix this vulnerability. The fix involves modifying the _get_tag() method to route file opening through nltk.pathsec.validate_path() with the corpus root as a required root or through CorpusReader.open(), instead of calling Python's builtin open() on a plain string path. Users should apply the official patch or upgrade to a fixed version to ensure path validation is enforced and symlink-based arbitrary file reads are prevented.