A path traversal vulnerability in the Natural Language Toolkit (NLTK) component NKJPCorpusReader allows an attacker to read arbitrary files outside the intended corpus root directory. This occurs because NKJPCorpusReader constructs file paths via unsafe string concatenation and uses the builtin open() function directly, bypassing NLTK's pathsec sandbox protections even when strict enforcement mode (ENFORCE=True) is enabled. The vulnerability was confirmed in NLTK version 3.9.4 and the current development branch. An attacker controlling the fileids argument can exploit this to read sensitive files outside the corpus root.