CVE-2026-62383

CVE-2026-62383 is a path traversal vulnerability in NLTK's IPIPANCorpusReader. The bug itself is straightforward: the corpus reader doesn't validate symlinks when loading data from user-controlled paths, allowing an attacker to access files outside the intended corpus directory. But the surrounding context is what makes this worth your attention. NLTK ships a module called pathsec that explicitly validates file paths at certain boundaries. IPIPANCorpusReader bypasses this mechanism entirely. This isn't a simple missing check—it's evidence of a security boundary that exists in name but not in practice across the corpus reader architecture. When a library provides explicit path validation, developers reasonably assume all file operations flow through it. The existence of pathsec likely influenced how developers integrated these readers, potentially leading them to expose corpus loading to user-controlled paths they'd never have permitted with a library making no security claims. The CVSS of 5.5 reflects limited impact (file read only), but the ergonomic failure is severe. More importantly, examine your own codebase: if you're using any NLTK CorpusReader with paths derived from user input, that assumption is now invalid regardless of what the documentation suggested. The fix in IPIPANCorpusReader doesn't automatically apply to other corpus reader implementations—audit every CorpusReader subclass you're using. The pattern of pathsec existing while corpus readers bypass it suggests either reactive patching without full audit coverage or architectural drift. Either way, treat the entire corpus reader module as untrusted until you've verified the specific implementation you use has proper path validation. The presence of a security mechanism that can be bypassed creates more danger than no mechanism at all, because it trains developers to trust what they shouldn't.

Reviewed through automated stages and approved by a human before publication.