Path Traversal in NLTK Corpus Readers

Executive Summary

This vulnerability affects NLTK versions before 3.10.3. It involves a path traversal issue in corpus readers where symlinks can escape trusted roots. Attackers can stage symlinked corpus files under a trusted data root and disclose outside-root content through methods like channels(), domains(), and synonyms(). The issue occurs because corpus readers use built-in open() instead of nltk.pathsec.open(), bypassing security boundaries.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is below 3.10.3, the system is vulnerable. Inspect corpus readers for direct open() calls instead of nltk.pathsec.open().

Look for symlinked files under trusted corpus roots. Review IPIPANCorpusReader, CrubadanCorpusReader, and LinThesaurusCorpusReader implementations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive files outside the intended data root by creating symlinks. This could lead to unauthorized disclosure of confidential data if corpus files are accessed through vulnerable readers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected NLTK versions may face compliance risks due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later. Replace direct open() calls in affected corpus readers with nltk.pathsec.open().

Remove or quarantine any suspicious symlinked files under corpus roots. Review and harden global-sandbox fallback cases.

Useful 0 Not Useful 0