CVE-2026-62383 Overview
CVE-2026-62383 is a symlink-based arbitrary file read vulnerability in the Natural Language Toolkit (nltk) Python library. Versions before 3.10.2 contain flawed IPIPANCorpusReader methods that bypass the nltk.pathsec validation logic. An attacker with local access to the corpus root directory can place a symbolic link pointing to a sensitive file. Calling channels(), domains(), categories(), or fileids() with the symlink filename causes the reader to follow the link and return the target file's contents. This exposes any file readable by the process to the attacker, categorized as a path traversal weakness [CWE-22].
Critical Impact
Local attackers can read arbitrary files accessible to the nltk process by planting a symlink in the corpus root and invoking IPIPAN reader methods.
Affected Products
- nltk versions prior to 3.10.2
- Applications embedding IPIPANCorpusReader for Polish IPI PAN corpus processing
- Python data science and NLP pipelines that expose corpus root directories to untrusted input
Discovery Timeline
- 2026-08-22 - CVE-2026-62383 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-62383
Vulnerability Analysis
The nltk library provides IPIPANCorpusReader to parse corpora produced by the Polish Institute of Computer Science (IPI PAN). The reader exposes helper methods including channels(), domains(), categories(), and fileids(). These accept filenames scoped to the corpus root directory.
nltk ships a path sanitization module named nltk.pathsec intended to reject unsafe file references such as symbolic links pointing outside the corpus root. The affected IPIPANCorpusReader methods do not invoke this validation. Path handling is delegated directly to the operating system, which transparently resolves symlinks.
An attacker who can write to the corpus root can place a symlink named, for example, leak.xml that targets /etc/passwd, a private key, or application configuration files. Calling the reader method with leak.xml returns the target file's contents to the caller. The impact is scoped to files readable by the process user identity.
Root Cause
The root cause is missing path validation in the IPIPANCorpusReader code path. Filenames flow to file open operations without nltk.pathsec checks, so symbolic links resolve to targets outside the intended corpus directory. This is a classic symlink following flaw mapped to [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).
Attack Vector
Exploitation requires local access with permissions to write into the corpus root directory consumed by the vulnerable application. The attacker creates a symbolic link inside that directory and induces the application to invoke one of the affected reader methods with the symlink filename. No user interaction is required beyond the normal application workflow. Confidentiality of any process-readable file is at risk; integrity and availability are unaffected. See the VulnCheck Advisory for further technical detail.
Detection Methods for CVE-2026-62383
Indicators of Compromise
- Symbolic links present within directories used as IPIPANCorpusReader corpus roots, particularly those resolving outside the corpus tree.
- Application logs showing calls to channels(), domains(), categories(), or fileids() referencing filenames that resolve to system paths such as /etc/, ~/.ssh/, or application secret directories.
- Unexpected file access syscalls (for example, openat) from Python processes targeting files unrelated to NLP workloads.
Detection Strategies
- Inventory Python environments and identify installations of nltk at versions below 3.10.2 using pip list or software composition analysis tooling.
- Instrument application logging to record filenames passed to IPIPANCorpusReader methods and flag entries that resolve to symlinks via os.path.islink().
- Enable filesystem auditing (auditd on Linux) on corpus directories to record symlink creation events and subsequent reads.
Monitoring Recommendations
- Monitor process file access telemetry for Python interpreters opening sensitive files outside declared working directories.
- Alert on creation of symbolic links inside directories designated as corpus roots or other application-managed input paths.
- Track nltk package version drift across development, staging, and production Python environments.
How to Mitigate CVE-2026-62383
Immediate Actions Required
- Upgrade nltk to version 3.10.2 or later in all Python environments consuming the library.
- Audit application code for uses of IPIPANCorpusReader and validate that corpus root directories are not writable by untrusted users.
- Rotate any credentials or secrets stored on hosts where a vulnerable nltk deployment processed attacker-controlled corpus directories.
Patch Information
The maintainers released a fix in nltk3.10.2. Details are documented in the GitHub Security Advisory GHSA-3hhw-38pf-pxj6. Upgrade with pip install --upgrade nltk.
Workarounds
- Restrict write permissions on corpus root directories so that only trusted service accounts can add files.
- Pre-validate filenames passed to IPIPANCorpusReader methods with os.path.realpath() and reject any path that resolves outside the corpus root.
- Run applications that invoke nltk under least-privilege service accounts so that arbitrary file reads cannot reach sensitive system files.
# Configuration example
pip install --upgrade 'nltk>=3.10.2'
pip show nltk | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
