NLTK versions prior to 3.10.0 contain a logic defect in the FileSystemPathPointer.open() method, where the sandbox validation erroneously compares a normalized path to itself, effectively disabling the security check. This flaw allows callers to supply file:// URLs to nltk.data.load(), causing the library to open any local file that the executing process can read, including credentials or other configuration files. The primary consequence is the confidentiality compromise of arbitrary files accessible to the process user.

The vulnerable product is the Python Natural Language Toolkit (NLTK) for all releases before 3.10.0. Any installation of NLTK earlier than that release is susceptible to the flaw.

The CVSS score of 7.1 classifies this as high impact to confidentiality. The EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the weakness in contexts where they control the input to nltk.data.load(), such as web or server applications that parse user-supplied data, or a local attacker possessing execution rights in the same process. Successful exploitation grants the attacker read access to any file the process user can access, potentially exposing sensitive information.