The Natural Language Toolkit (NLTK) before version 3.9.4 contains a vulnerability (CVE-2026-70626) in the CorpusReader.open() method. The vulnerability arises because the path validation performed is lexical and does not resolve symbolic links, allowing an attacker with local access to create symlinks inside the corpus root directory that point to files outside this boundary. This enables unauthorized reading of arbitrary files on the system. The CVSS 3.1 score is 6.2, reflecting a high severity with local attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is classified under CWE-59 (Improper Link Resolution). No known exploits in the wild have been reported, and no patch links or vendor advisories are currently available.

Local attackers can read arbitrary files outside the corpus root directory, potentially exposing sensitive information. The vulnerability does not allow modification or denial of service but compromises confidentiality. Since no privileges are required and no user interaction is needed, the risk is elevated for local users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to trusted users only and avoid placing untrusted symlinks in corpus directories. Monitor for vendor updates to apply an official patch once released.