Gptline: NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292) (CVE-2026-62384)

This vulnerability is a new, distinct bypass of the fix for CVE-2026-54292 in NLTK's FramenetCorpusReader. The original fix blocked unsafe path components like '/', '\\', '..', and Windows drive prefixes but did not resolve symlinks. Attackers can place a symlink inside the corpus directory with a name containing no separators, which passes the path component check but points outside the corpus root. The affected methods (frame_by_name, _lu_file, doc) use a lexical path join and open files without enforcing the required root directory constraint, allowing arbitrary XML file reads outside the corpus root. The recommended fix is to route these calls through CorpusReader.open() or use validate_path() with required_root enforcement, as done in other parts of the codebase.

An attacker with the ability to place symlinks inside the corpus directory can read arbitrary XML files outside the intended corpus root without any special user interaction or malicious file opening. This can lead to unauthorized disclosure of sensitive information stored outside the corpus root. The vulnerability does not allow modification or deletion of files, only reading. It affects core corpus-reader code used in shared or multi-tenant environments.

A patch is available that routes the affected file access methods through CorpusReader.open() or uses validate_path() with required_root enforcement to properly resolve symlinks and restrict file reads to within the corpus root. Users should apply the official fix to prevent symlink-based sandbox bypass. Until patched, avoid using untrusted or shared corpus directories where attackers can plant symlinks.