CVE-2026-70626

CVE-2026-70626 is a symlink-following flaw (CWE-59) in the NLTK Python library: CorpusReader.open() and FileSystemPathPointer.join() enforce the corpus-root boundary only lexically via os.path.normpath() and never resolve symlinks. An attacker who can place or influence a symlink inside the corpus root can request a file ID such as link/secret.txt — containing no absolute path or '..' — that lexically stays under the root but resolves to an arbitrary file elsewhere on the filesystem. Successful abuse yields arbitrary local file reads with the privileges of the process running NLTK, bypassing the corpus-root restriction that applications may rely on as a security boundary. Impact is limited to deployments of the pip-installed nltk package that use CorpusReader or FileSystemPathPointer to restrict file access, and only where the attacker can plant symlinks under the corpus root, consistent with the CVSS 4.0 local attack vector (8.6 high). No in-the-wild exploitation or public PoC is currently known (EPSS 0.2%, percentile 11; not in CISA KEV).

What to do: No fixed version is specified in the available data, so track upstream NLTK releases and upgrade to the first patched release when it is published. Until then, prevent untrusted users from creating symlinks within corpus roots, treat CorpusReader.open()/FileSystemPathPointer.join() boundaries as advisory rather than a security control, and have applications resolve the final path (realpath) and confirm it remains under the root before opening. Audit any deployment that uses these APIs as a file-access sandbox for attacker-influenceable corpus directories.