NLTK versions prior to 3.10.2 have a symlink-based sandbox bypass in the FramenetCorpusReader that lets a program read any XML file outside the intended corpus directory. The flaw occurs when a symlink with a name that contains no path separators is placed inside the corpus subdirectory; the path validation check is bypassed and the symlink resolves to a target file elsewhere on the system. This vulnerability is a CWE‑22 type input validation failure and enables a confidentiality breach because arbitrary files can be read through the library's public methods.

The affected product is the NLTK library from the nltk vendor. Versions earlier than 3.10.2 are vulnerable. All installations that use the FramenetCorpusReader class are impacted when they allow users to create or supply corpus directories with symlinks.

The CVSS score of 8.7 indicates a high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or semi‑trusted, requiring the attacker to write a symlink into a corpus directory that the application later processes. Once the symlink is in place, the application can read any file accessible to the process, potentially exposing sensitive data.