The vulnerability allows an attacker who can supply the fileid argument to the StreamBackedCorpusView class in NLTK to read arbitrary files from the local filesystem. By calling builtins.open() instead of the library’s pathsec.open() wrapper, the code bypasses the ENFORCE check that normally restricts access to safe paths. This flaw is a classic directory traversal or path traversal issue (CWE‑22) and can expose sensitive system files and credentials that the process has permission to read.

Any project that depends on the NLTK library before version 3.10.0 is affected. The vulnerability is present in all products that import nltk and use the StreamBackedCorpusView class without upgrading to 3.10.0 or later.

The CVSS score of 8.7 indicates high severity. Although an EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the likelihood of exploitation remains significant for attackers who can influence the fileid argument. The flaw is local in nature; it does not require network access but still demands knowledge of the library usage and the ability to manipulate function arguments.