NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.

NLTK versions prior to 3.10.2 are vulnerable to a symlink-based sandbox bypass in the FramenetCorpusReader component. Attackers who can place symlinks inside the corpus subdirectory can bypass path validation guards because the validation only checks that filenames contain no path separators. When these symlinks are resolved by methods such as frame_by_name(), _lu_file(), or doc(), they can point to arbitrary XML files outside the intended corpus root directory. This allows unauthorized read access to sensitive files on the filesystem. The vulnerability requires the attacker to have write access to the corpus subdirectory to plant malicious symlinks. The fix is available in NLTK version 3.10.2 and later. Users are advised to upgrade immediately to mitigate the risk of arbitrary file read.