Executive brief
NLTK is a popular Python library used for natural language processing tasks. A symlink escape vulnerability in the CorpusReader component allows local attackers to read arbitrary files on the system by placing symlinks inside the corpus root directory. An attacker with the ability to influence files in a corpus directory can bypass file access restrictions and expose sensitive data such as configuration files, credentials, or system files that the application has permission to read.
Technical details
The vulnerability is a symlink escape / improper link resolution issue (CWE-59) in nltk.corpus.reader.api.CorpusReader.open() and nltk.data.FileSystemPathPointer.join(). The root cause is that path validation uses only lexical path normalization via os.path.normpath(), which does not follow symlinks to their actual targets on the filesystem. An attacker who can place a symlink inside the corpus root directory can construct a file path that appears to remain within the root lexically but resolves to an arbitrary location outside the root when symlinks are dereferenced. The attack requires local filesystem access to place the symlink and knowledge of the target file location. Exploitation allows reading arbitrary files with the privileges of the running NLTK process, including system files like /etc/hostname or application secrets. A patch was released in version 3.9.4 that properly resolves symlinks using os.path.realpath() before validating boundaries.
Affected products
- NLTK Project NLTK <= 3.9.3
Timeline
- 2026-08-07: disclosed
- 2026-08-07: patched: Version 3.9.4 released with fix
- 2026-08-22: advisory: GHSA-r6gq-whwq-mvg9 published
- 2026-09-02: other: Duplicate advisory GHSA-8h9m-22mv-qv5r withdrawn