CyberRota Analysis
AI-GeneratedNLTK versions prior to 3.10.3 are susceptible to a path traversal vulnerability in corpus readers, which allows attackers to exploit symlinked corpus files to access content outside of trusted data roots. This can lead to unauthorized disclosure of sensitive information through standard corpus reader methods. Organizations using affected NLTK versions should prioritize updating to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content through normal corpus reader methods like channels(), domains(), and synonyms().
Related CVEs
Other vulnerabilities affecting the same vendor(s)