Gptline: NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root (CVE-2026-70626)

The vulnerability in nltk.corpus.reader.api.CorpusReader.open() arises because the method blocks absolute paths and '..' traversal lexically but does not resolve symbolic links before verifying that a requested file path remains within the configured corpus root. The check uses os.path.normpath on the joined path but does not account for symlinks that may point outside the root directory. An attacker placing a symlink inside the corpus root that points to an arbitrary file outside the root can cause the application to read files outside the intended sandbox. This leads to arbitrary local file read and filesystem sandbox escape for applications relying on CorpusReader or FileSystemPathPointer to restrict file access. The issue was demonstrated with a proof-of-concept that reads files such as /etc/hostname by symlink escape.

This vulnerability allows an attacker who can place or influence files inside the allowed corpus root directory to read arbitrary local files outside that root, including application secrets, local configuration files, private datasets, and system files readable by the application user. It bypasses the intended filesystem sandbox restrictions, potentially exposing sensitive information. The impact is limited to local file disclosure; there is no indication of code execution or integrity impact.

A patch is available for this vulnerability. Users should update to a fixed version of NLTK that properly resolves symlinks before enforcing path restrictions to prevent filesystem sandbox bypass. Until patched, applications should avoid processing untrusted corpus directories or files that may contain symlinks. No vendor advisory content contradicts this; thus, applying the official fix is recommended.