Executive brief
NLTK's FramenetCorpusReader is a library component for parsing linguistic corpus data. An attacker who can place a symlink inside a shared or multi-tenant corpus directory can exploit a gap in the path validation logic to read arbitrary XML files outside the intended corpus root, exposing sensitive data to other users or applications on the system.
Technical details
The vulnerability is a symlink-based sandbox bypass in the FramenetCorpusReader class (nltk/corpus/reader/framenet.py). The underlying issue is that a prior fix (for CVE-2026-54292) added _reject_unsafe_path_component() to block path traversal patterns (/, \, .., drive letters), but the three vulnerable call sites (frame_by_name, _lu_file, doc) still use self.abspath() for lexical path joining rather than the symlink-resolving, scope-checked CorpusReader.open() method used elsewhere. A symlink placed in a corpus subdirectory with a name containing no separators passes the guard and allows reading arbitrary files when followed. No user interaction or special preconditions are required beyond access to place a symlink in a shared corpus directory—a scenario explicitly named in NLTK's threat model. The fix is to route these three call sites through CorpusReader.open() or pass required_root to validate_path() directly, as the related NKJPCorpusReader already does.
Affected products
- NLTK NLTK >= 3.10.0, < 3.10.2
Timeline
- 2026-09-08: disclosed: GHSA-f833-7jw8-xwrv published
- 2026-09-08: patched: Fixed in NLTK 3.10.2 (commit 736d3212a47de2005b85b785dde6720556d3925d)