Link following in Natural Language Toolkit - #VU141255
Published: August 7, 2026
Vulnerability identifier: #VU141255
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper link resolution before file access in nltk.corpus.reader.api.CorpusReader.open() and FileSystemPathPointer.join() when opening corpus files through a symlink placed under the corpus root. A local user can place or influence a symlinked path inside the allowed corpus root to disclose sensitive information.
The issue bypasses the intended filesystem boundary because the path check is performed on the lexical path rather than the resolved path after following symlinks.
Affected software
Natural Language Toolkit
Remediation
Install security update from vendor's website.
Natural Language Toolkit - update to 3.9.4