CVE-2026-62384

CVE-2026-62384 is a new, distinct symlink-based bypass of the path-security sandbox in NLTK's FramenetCorpusReader, defeating the fix released in PR #3581 for the earlier FrameNet path-traversal issue CVE-2026-54292 (GHSA-xh95-f55m-82fw). The guard added by that fix, _reject_unsafe_path_component(), only blocks literal path separators, '..' and Windows drive prefixes and never resolves symlinks, and the affected call sites (frame_by_name(), _lu_file() and doc() in nltk/corpus/reader/framenet.py) then perform a lexical abspath() join and open the result via PathPointer.open() with no required_root check, so a separator-free symlink planted inside a FrameNet corpus subdirectory (e.g. frame/) is followed to any file outside the corpus root. An attacker who can plant a symlink in a corpus directory that the application then reads gains disclosure of the contents of XML files located outside the corpus root, since the file is parsed through XMLCorpusView and its parsed fields (such as the frame definition) are returned to the caller; CVSS 4.0 rates this 8.7 High with a network vector and confidentiality-only impact. Anyone running an unpatched nltk installation from the pip ecosystem whose code loads FrameNet data from a directory an attacker can influence is affected, while deployments that only load trusted, locally controlled NLTK data face little risk. No in-the-wild exploitation is known, the flaw is not in CISA KEV, EPSS gives roughly 0.6% odds of exploitation within 30 days (45th percentile), and a self-contained runnable proof of concept is included in the advisory.

What to do: If your applications use FramenetCorpusReader (frame_by_name(), _lu_file(), or doc()), upgrade nltk to the patched release for CVE-2026-62384 once published, since no fixed version number is stated in the available data. Until then, keep FrameNet corpus directories (frame/ and the LU and fulltext subdirectories) writable only by trusted principals, audit them for symlinks pointing outside the corpus root, and treat user-supplied corpus archives as untrusted.