Arbitrary File Read Vulnerability in NLTK Product by NLTK

CVE-2026-62383

What is CVE-2026-62383?

The NLTK library is vulnerable to an arbitrary file read due to a symlink-based issue in the IPIPANCorpusReader methods. The vulnerability allows attackers to create a symlink in the corpus root directory, which can then be exploited to read any arbitrary files that are accessible to the NLTK process. This can be achieved by invoking methods such as channels(), domains(), categories(), or fileids() with the symlink filename, resulting in potential unauthorized data exposure.

References