The vulnerability exists in NLTK versions before 3.9.4 when the CorpusReader opens files. Path validation is performed only lexically and does not resolve symbolic links, so an attacker who can place a symlink within a corpus directory can point that link to a file outside the intended root. This flaw allows a local attacker to read any file that the process can access, compromising confidentiality. The weakness is a path traversal flaw (CWE‑59, CWE‑22).

All installations of the NLTK library that use CorpusReader and are running a version older than 3.9.4 are affected. Any environment where an attacker can write into the corpus root—regardless of operating system or corpus content—provides a vector for exploitation.

The base CVSS score of 8.6 indicates high severity. The EPSS score is reported as < 1%, indicating a low exploitation probability. The technical barrier to exploitation is low once the attacker can create a symlink in the corpus directory. The flaw is not listed in the CISA KEV catalog. A local privileged attacker could read critical configuration files or secrets if the corpus root is writable, and automated tools that load corpora could be used to harvest data. Immediate patching is recommended to avoid this confidentiality breach.