CVE-2026-62383: nltk IPIPANCorpusReader Symlink Arbitrary File Read

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-22 · updated 2026-10-14
Weakness: CWE-22

Description

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.

Affected products

nltk: from 3.10.0 before 3.10.2 — fixed in 3.10.2

How to fix

Upgrade to a fixed version: nltk 3.10.2. Check the vendor advisory for mitigations.

References

https://github.com/nltk/nltk/security/advisories/GHSA-3hhw-38pf-pxj6
https://www.vulncheck.com/advisories/nltk-ipipancorpusreader-symlink-arbitrary-file-read

Get alerted when CVE-2026-62383 or the next vulnerability affects your stack