NLTK versions up to and including 3.9.2 contain a path traversal vulnerability in multiple CorpusReader classes, allowing attackers to read arbitrary files on the server. This occurs due to improper sanitization of file paths in classes such as WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. Exploitation can lead to unauthorized access to sensitive files and potentially escalate to remote code execution when combined with other vulnerabilities. A fix is available in version 3.9.3.