CyberRota Analysis
AI-GeneratedVersions of nltk prior to 3.10.2 are vulnerable to a symlink-based arbitrary file read vulnerability, allowing attackers to bypass path security validation. By placing a symlink in the corpus root directory, an attacker can exploit methods such as channels(), domains(), categories(), or fileids() to access sensitive files within the system. Organizations using affected versions of nltk should prioritize updating to mitigate the risk of unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.
Related CVEs
Other vulnerabilities affecting the same vendor(s)