The vulnerability resides in the filestring() function of nltk.util. It lacks proper sanitization of input paths, allowing an attacker to specify absolute or traversal paths and read arbitrary files from the system. This flaw is identified as CWE‑22 (Path Traversal) and CWE‑36 (Absolute Path Traversal). The primary impact is the potential unauthorized access to sensitive files, which compromises data confidentiality.

The affected product is the Natural Language Toolkit hosted by the nltk organization, specifically version 3.9.2. No other versions or sub‑products were listed as affected.

The CVSS score of 7.5 indicates a high severity level, but the EPSS score is below 1%, meaning the likelihood of exploitation in the wild is low. The vulnerability is not yet listed in the CISA KEV catalog. An attacker can exploit the flaw locally by running code that calls filestring, or remotely if the function is exposed through a web API or user‑provided input. Successful exploitation would allow reading of arbitrary files, potentially exposing credentials, configuration, or other sensitive data.