The NLTK FramenetCorpusReader.frame() method contains a path traversal vulnerability that allows an attacker to read arbitrary XML files outside the intended corpus root directory. This occurs because the method constructs file paths from user-supplied frame names without proper containment checks and bypasses the nltk.pathsec sandbox enforcement. The vulnerability affects versions prior to 3.10.0 and certain 1.0.8 versions. A proof-of-concept demonstrates that an attacker can read sensitive XML files outside the corpus root despite strict sandbox enforcement. The vulnerability has a CVSS score of 7.5 (high severity) and a patch is available.