Affected: nltk

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.

Affected: PyPI: nltk

### Summary `nltk.corpus.reader.api.CorpusReader.open()` can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and `..` traversal, the current boundary check is only lexical and does not account for symlink resolution. This leads to an arbitrary local file read / filesystem sandbox bypass for applications that rely on `CorpusReader` or `FileSystemPathPointer` to restrict file access.

### Details The vulnerable flow is:

- [`nltk/corpus/reader/api.py:222`](/mnt/Data/my_brains/test/nltk/nltk/corpus/reader/api.py#L222) - `CorpusReader.open()` blocks absolute paths and `..`, then calls `self._root.join(file).open()`

- [`nltk/data.py:398`](/mnt/Data/my_brains/test/nltk/nltk/data.py#L398) - `FileSystemPathPointer.join()` joins the requested file ID and checks whether the resulting path still appears to remain under the configured root

The problem is that the check is based on the lexical path after `os.path.normpath()`, not on the resolved path after following symlinks.

Current behavior:

1. `CorpusReader.open()` rejects: - absolute paths - `..` path traversal 2. `FileSystemPathPointer.join()` computes: - `joined = os.path.normpath(os.path.join(self._path, fileid))` - `root = os.path.normpath(self._path)` 3. It allows the access if `joined` starts with `root`

This misses the case where a path stays inside the root lexically, but resolves outside the root via a symlink already prese…

Affected: PyPI: nltk

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.