8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-79676

CVE-2026-79676: NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

Summary

Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open() rather than nltk.pathsec.open().

Details

Vulnerability type: Path traversal and symlink boundary bypass
Affected component: nltk.corpus.reader.ipipan, nltk.corpus.reader.crubadan, nltk.corpus.reader.lin
Affected versions: Published 3.9.4 and current source v3.10.0-rc2 both reproduced.
Patched versions: Not yet patched
Root cause: Root-derived paths are reopened with raw open() without preserving the trusted-root boundary.

IPIPANCorpusReader opens header.xml derived from morph.xml, CrubadanCorpusReader opens table.txt directly, and LinThesaurusCorpusReader opens simN.lsp paths returned from its own root helpers. Under pathsec.ENFORCE=True, a symlink placed inside the trusted corpus root can point outside the root and still be parsed successfully. It was confirmed parsed outside-root content is returned through public methods such as channels(), domains(), categories(), langs(), crubadan_to_iso(), synonyms(), and scored_synonyms().

PoC

Preconditions

The application processes attacker-influenced corpora inside a trusted NLTK data root or trusted corpus directory.

Steps

Miggo Vulnerability Database

→

CVE-2026-79676

CVE-2026-79676:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nltk	pip	<= 3.10.2	3.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-79676, stems from a path traversal and symlink boundary bypass in the NLTK library. Multiple corpus readers were found to use Python's built-in open() or codecs.open() functions to read files from paths derived from corpus data. These functions do not properly handle symlinks, allowing an attacker to create a malicious corpus with symlinks that point to files outside the intended corpus directory (e.g., /etc/passwd). When the NLTK application processes this corpus, it follows the symlinks and reads the content of the external files, leading to information disclosure. The vulnerability exists because the file opening operations were not channeled through NLTK's own security-aware nltk.pathsec.open() function, which is designed to prevent such directory traversal. The patch remediates this by replacing all identified instances of insecure file opening in the corpus readers with the hardened pathsec_open function, which enforces trusted-root boundaries and includes additional guards against TOCTOU race conditions and hardlink-based escapes.

Vulnerable functions

load_ace_file

nltk/chunk/named_entity.py

The function uses the built-in `open()` to read `annfile` and `textfile`. An attacker could provide a symlink as the file path, causing the function to read a file from an unintended location outside the designated corpus root.

CrubadanCorpusReader._load_lang_mapping_data

nltk/corpus/reader/crubadan.py

The function opens `mapper_file` (which points to `table.txt`) using the built-in `open()`. This allows an attacker who can control the corpus to use a symlink to read arbitrary files on the system.

CrubadanCorpusReader._load_lang_ngrams

nltk/corpus/reader/crubadan.py

The function constructs `ngram_file` from data read from `table.txt`, which can be attacker-influenced. It then opens this file using the built-in `open()`, creating a path traversal vulnerability if the path contains a symlink.

IPIPANCorpusReader._get_tag

nltk/corpus/reader/ipipan.py

Although a `validate_path` call existed, the function still used the built-in `open()`. This is vulnerable to a Time-of-check/Time-of-use (TOCTOU) race condition, where the file could be replaced with a symlink between validation and opening. The patch replaces both calls with a single atomic `pathsec_open`.

LinThesaurusCorpusReader.__init__

nltk/corpus/reader/lin.py

The constructor iterates over file paths in the corpus and opens them using the built-in `open()`. This allows an attacker to place a symlink in the corpus, causing the reader to load and parse a file from outside the intended corpus root.

MTEFileReader.__init__

nltk/corpus/reader/mte.py

The constructor for `MTEFileReader` did not validate the `file_path` it received. Other methods in `MTECorpusReader` would instantiate this class with a path joined from the corpus root, which could be a symlink pointing outside the root, leading to a path traversal vulnerability.

XML_Tool.build_preprocessed_file

nltk/corpus/reader/nkjp.py

The function opens `self.read_file` using the built-in `open()`. Since `self.read_file` is constructed from a path within the corpus, a symlink could be used to make it point to an external file, leading to information disclosure.

Pl196xCorpusReader._init_textids

nltk/corpus/reader/pl196x.py

The function opens the `_textids` file using the built-in `open()`. If an attacker can control the corpus files, they can replace the textids file with a symlink to an arbitrary file, which will then be read by the application.

XMLCorpusReader._detect_encoding

nltk/corpus/reader/xmldocs.py

When `fileid` is a string path instead of a `PathPointer` object, the function used the built-in `open()`. This bypasses the security checks and allows a symlink to be followed, leading to arbitrary file read.

StandardFormat.open

nltk/toolbox.py

When `sfm_file` is a string path, the function used `codecs.open()`, which is also vulnerable to path traversal via symlinks. An attacker could provide a malicious corpus where `sfm_file` is a symlink to an external file.