NLTK versions 3.9.4 through 3.10.2 contain a directory traversal flaw in the CrubadanCorpusReader. The _load_lang_ngrams routine concatenates the corpus root with a value read from the corpus table.txt file and opens the resulting path with the built‑in open() function rather than the pathsec‑validated opener. Because os.path.join removes the root when the value is an absolute path, the code can access files outside the corpus directory. Files ending in –3grams.txt that contain token count lines are exposed, allowing an attacker who can supply a corpus package to read sensitive files on the system. This vulnerability matches CWE‑22 and can lead to untrusted disclosure of local files.

The affected product is the Natural Language Toolkit (NLTK) library distributed by the nltk vendor. Versions 3.9.4 up to and including 3.10.2 are impacted. Any Python environment that installs one of these releases and loads a corpus using CrubadanCorpusReader is susceptible.

The CVSS score is 2, indicating low severity, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is unavailable, so the exploitation probability is unknown but unlikely to be high. Exploitation requires the attacker to supply or influence the loading of a corpus package; therefore, the risk is limited to situations where untrusted data packages are imported. The attack surface is confined to files named –3grams.txt that have the correct format, further reducing the overall risk.