CVE-2026-62383 in NLTK
Summary
by MITRE • 08/22/2026
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Natural Language Toolkit, commonly known as NLTK, is a widely used Python library for symbolic and statistical natural language processing. It provides easy-to-use interfaces to over fifty corpora and lexical resources such as WordNet along with classes for text classification, tokenization, stemming, tagging, parsing, and semantic reasoning. Versions prior to 3.10.2 contain a critical security flaw within the IPIPANCorpusReader class that allows attackers to perform arbitrary file reads through symlink manipulation. This vulnerability arises because the reader methods do not adequately validate or sanitize paths before accessing files on the filesystem, effectively bypassing the library's internal pathsec validation mechanisms designed to prevent directory traversal and unauthorized access.
The technical root cause of this vulnerability lies in how the IPIPANCorpusReader handles file identification requests. When an attacker invokes methods such as channels(), domains(), categories(), or fileids() with a filename that corresponds to a symbolic link, the underlying filesystem resolves the symlink to its target location without checking if the final destination is within the allowed corpus directory structure. By placing a maliciously crafted symbolic link in the corpus root directory pointing to sensitive system files or application-specific data outside the intended scope, an attacker can trick the reader into exposing contents that should remain inaccessible. This bypasses nltk.pathsec validation entirely because the initial path provided by the user appears valid within the local context of the symlinked file's location rather than its ultimate target.
From a security classification perspective, this issue aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-59: Improper Link Resolution Before File Access. The vulnerability represents an insecure direct object reference where the application trusts user-supplied input without sufficient verification against access control policies. In terms of attack vectors, this falls under ATT&CK technique T1083: File and Directory Discovery, as it enables unauthorized enumeration and reading of files on the host system. If NLTK is integrated into a web service or an automated data processing pipeline that processes untrusted corpus inputs, this flaw can lead to significant information disclosure vulnerabilities where sensitive configuration files, source code, credentials, or private user data are exposed to remote attackers.
The operational impact of exploiting this vulnerability depends heavily on the context in which NLTK is deployed. In standalone scripts with limited file permissions, the damage may be restricted to files readable by the executing user account. However, in server-side applications running with elevated privileges or accessing sensitive directories such as /etc/passwd, database configuration files, or application secrets stored alongside corpus data, the impact can range from moderate information leakage to full system compromise if combined with other vulnerabilities like remote code execution via crafted pickle deserialization often found in NLP libraries. Attackers could use this capability for reconnaissance, mapping out internal file structures and identifying high-value targets within the host environment before launching further exploitation attempts.
To mitigate this vulnerability, organizations must immediately upgrade NLTK to version 3.10.2 or later where these path validation checks have been strengthened to resolve symlinks and verify that the final resolved path remains within the designated corpus directory boundaries. For systems unable to update promptly due to dependency constraints, defensive coding practices should be implemented by manually validating all file paths passed to NLTK readers using os.path.realpath() to ensure they do not escape the expected root directory before invoking any reader methods. Additionally, running applications with minimal necessary filesystem permissions and isolating corpus data in restricted directories can reduce the blast radius of potential exploitation attempts. Regular security audits of third-party library usage are essential to maintain robust defenses against such path traversal and symlink-based attacks.