Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-22T14:12:36 nltk: nltk: Information disclosure via symlink in IPIPANCorpusReader 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE-22

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.

A flaw was found in nltk. A local attacker can exploit a symlink-based vulnerability in the IPIPANCorpusReader methods. By placing a symbolic link in the corpus root directory and invoking specific methods, an attacker can bypass security validation and read arbitrary files accessible to the process. This could lead to unauthorized information disclosure.

The `nltk` library is vulnerable to information disclosure, allowing an attacker with local access and low privileges to read arbitrary files. This occurs if an attacker can place a symlink within the `nltk` corpus root directory, bypassing path validation and enabling access to sensitive data with the permissions of the running process. To mitigate this vulnerability, restrict write access to the `IPIPANCorpusReader` corpus root directory. Ensure that only trusted users or processes have permissions to create or modify files within this directory. This prevents an attacker from placing malicious symlinks that could lead to arbitrary file disclosure. Exploit Intelligence Not affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Lightspeed Core Not affected lightspeed-core/lightspeed-stack-rhel9 Lightspeed Core Not affected lightspeed-core/rag-tool-cpu-rhel9 Lightspeed Core Not affected lightspeed-core/rag-tool-cuda-12.9-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-service-api-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-ogx-core-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-ta-lmes-job-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-62383 https://nvd.nist.gov/vuln/detail/CVE-2026-62383 https://github.com/nltk/nltk/security/advisories/GHSA-3hhw-38pf-pxj6 https://www.vulncheck.com/advisories/nltk-ipipancorpusreader-symlink-arbitrary-file-read