NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.

A flaw was found in NLTK. The FramenetCorpusReader component is vulnerable to a symlink-based sandbox bypass. An attacker can exploit this by placing specially crafted symbolic links within a corpus subdirectory. These symlinks bypass path validation, allowing the attacker to read arbitrary XML files located outside the intended corpus root, leading to information disclosure.

A path traversal vulnerability exists in NLTK's FramenetCorpusReader component via symbolic links. When resolving corpus files using methods like frame_by_name(), _lu_file(), or doc(), path validation checks fail to restrict symlinks containing no path separators within subdirectories. An attacker capable of placing crafted symlinks in a corpus directory can read arbitrary XML files outside the intended corpus root. Confidentiality is impacted within the context of the running application, though standard Linux discretionary access controls and container boundaries restrict arbitrary file access beyond the process's effective permissions. Restrict write permissions on NLTK corpus subdirectories to prevent unauthorized symlink creation, or sanitize input paths to prevent FramenetCorpusReader from loading untrusted corpus files containing unresolved symbolic links. Exploit Intelligence Affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Lightspeed Core Affected lightspeed-core/lightspeed-stack-rhel9 Lightspeed Core Affected lightspeed-core/rag-tool-cpu-rhel9 Lightspeed Core Affected lightspeed-core/rag-tool-cuda-12.9-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-service-api-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-ogx-core-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-ta-lmes-job-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-62384 https://nvd.nist.gov/vuln/detail/CVE-2026-62384 https://github.com/nltk/nltk/security/advisories/GHSA-f833-7jw8-xwrv https://www.vulncheck.com/advisories/nltk-framenetcorpusreader-symlink-sandbox-bypass-before