CVE-2026-126304: Symlink Path Traversal in NLTK YCOECorpusReader

The Natural Language Toolkit (NLTK) provides standardized corpus readers to parse and process linguistic datasets stored on the local filesystem. Among these is the YCOECorpusReader class, defined in nltk/corpus/reader/ycoe.py, which manages the York-Toronto-Helsinki Parsed Corpus of Old English Prose (YCOE). This reader orchestrates access to two distinct dataset representations located in subdirectories beneath the corpus root: syntactic bracket-parse trees stored in the psd directory and part-of-speech tagged text stored in the pos directory.

In NLTK versions 3.10.0 through 3.10.3, YCOECorpusReader initializes its internal sub-readers without verifying whether the psd and pos paths resolve to locations inside the parent corpus root on the underlying filesystem. Specifically, the constructor invokes self.root.join("psd") and self.root.join("pos") to construct path pointers for YCOEParseCorpusReader and TaggedCorpusReader. While FileSystemPathPointer.join() performs a lexical check to verify that the resulting path string starts with the parent root prefix, it does not resolve symbolic links.

This discrepancy introduces an Improper Link Resolution Before File Access vulnerability, tracked as CWE-59 (with secondary classification under CWE-22, Path Traversal). In applications or machine learning pipelines that ingest corpus directories or extract corpus archives from external sources, an attacker can substitute the psd or pos subdirectories with symbolic links pointing outside the corpus boundary.

When the application subsequently invokes standard reader interface methods—such as words(), sents(), tagged_words(), or parsed_sents()—the sub-readers traverse the symbolic link and enumerate files in the target directory. This allows an unauthenticated attacker to read unauthorized files from sibling corpora, temporary workspaces, or other readable locations accessible within the NLTK path security sandbox.

The root cause of CVE-2026-126304 lies in the architectural boundary between lexical path representation in nltk.data.FileSystemPathPointer and canonical filesystem verification in nltk.pathsec. When YCOECorpusReader.__init__() is called, the root argument is normalized into a FileSystemPathPointer instance by the base CorpusReader class. The YCOECorpusReader constructor then derives the paths for its two child readers using self.root.join("psd") and self.root.join("pos").

The FileSystemPathPointer.join() method constructs a new path by joining the base path string with the relative identifier using standard path manipulation functions. To prevent basic dot-dot (../) traversal sequences, the lexical check verifies that the joined path string retains the prefix of self.root.path. For example, if self.root.path is /sandbox/nltk_data/corpora/ycoe, joining "pos" yields /sandbox/nltk_data/corpora/ycoe/pos. Because this string starts with /sandbox/nltk_data/corpora/ycoe, the lexical check succeeds without inspecting the filesystem inode.

Once self.root.join("pos") returns a new FileSystemPathPointer pointing to /sandbox/nltk_data/corpora/ycoe/pos, YCOECorpusReader passes this pointer directly as the authoritative root parameter to TaggedCorpusReader (and similarly passes psd to YCOEParseCorpusReader). The child readers treat the provided path pointer as their trusted base directory and apply regular expression filters (.*\.pos or .*\.psd) to discover all matching files beneath that directory.

Because no os.path.realpath() check was executed prior to instantiating the sub-readers, if /sandbox/nltk_data/corpora/ycoe/pos is a symbolic link pointing to /sandbox/nltk_data/corpora/private_dataset/pos, the child reader's root resolves directly to the external target. Any subsequent file operations performed by the child reader operate within the context of the symlink target, completely bypassing the intended confinement of the parent YCOECorpusReader root.

In vulnerable versions of NLTK (3.10.0 to 3.10.3), nltk/corpus/reader/ycoe.py defined YCOECorpusReader.__init__() by directly passing the result of self.root.join() into the sub-reader constructors:

class YCOECorpusReader(CorpusReader):
    """
    Corpus reader for the York-Toronto-Helsinki Parsed Corpus of Old
    English Prose (YCOE).
    """
    def __init__(self, root, encoding="utf8"):
        CorpusReader.__init__(self, root, [], encoding)
 
        # VULNERABLE: self.root.join() only performs a string-prefix check.
        # If 'psd' or 'pos' is a symlink pointing outside 'self.root',
        # the sub-reader initializes with an external directory as its root.
        self._psd_reader = YCOEParseCorpusReader(
            self.root.join("psd"), ".*", ".psd", encoding=encoding
        )
        self._pos_reader = TaggedCorpusReader(
            self.root.join("pos"), ".*", ".pos", encoding=encoding
        )

To remediate this flaw in Pull Request #3888 (commits 68434c0427f8d296f3adfddb518525038d1f7bfa and 2c563b13f9dce7c15eefd4b03463e1b69b64f1f3), the maintainers imported validate_path from the nltk.pathsec module and inserted an explicit containment verification loop prior to instantiating the child readers:

--- a/nltk/corpus/reader/ycoe.py
+++ b/nltk/corpus/reader/ycoe.py
@@ -24,6 +24,7 @@
 from nltk.corpus.reader.bracket_parse import BracketParseCorpusReader
 from nltk.corpus.reader.tagged import TaggedCorpusReader
 from nltk.corpus.reader.util import *
+from nltk.pathsec import validate_path
 from nltk.tokenize import RegexpTokenizer
 
 
@@ -37,6 +38,15 @@ class YCOECorpusReader(CorpusReader):
     def __init__(self, root, encoding="utf8"):
         CorpusReader.__init__(self, root, [], encoding)
 
+        # A psd/pos directory symlink escapes the corpus root: join() does a
+        # string-prefix check only, not symlink resolution, so files outside the
+        # YCOE corpus would be enumerated and read (CWE-59).
+        for sub in ("psd", "pos"):
+            validate_path(
+                self.root.join(sub),
+                context="YCOECorpusReader",
+                required_root=self.root,
+            )
+
         self._psd_reader = YCOEParseCorpusReader(
             self.root.join("psd"), ".*", ".psd", encoding=encoding
         )
         self._pos_reader = TaggedCorpusReader(
             self.root.join("pos"), ".*", ".pos", encoding=encoding
         )

The nltk.pathsec.validate_path() function resolves both the candidate path (self.root.join(sub)) and the required_root (self.root) using canonical filesystem resolution (os.path.realpath). It then verifies that the resolved subdirectory path is strictly contained within the resolved self.root directory tree.

If either psd or pos is a symbolic link pointing to a directory outside self.root, validate_path raises an exception during YCOECorpusReader.__init__() before YCOEParseCorpusReader or TaggedCorpusReader can be constructed or enumerate files. While this check prevents directory-level symlink escapes during initialization, a time-of-check to time-of-use (TOCTOU) window theoretically exists if an attacker has concurrent write access to replace the directory with a symlink after __init__() completes; however, in typical corpus ingestion workflows where archives are extracted prior to reader instantiation, the synchronous check at initialization effectively blocks exploitation.

Exploiting CVE-2026-126304 requires an application to initialize YCOECorpusReader on a directory structure controlled or supplied by an attacker, and subsequently return or expose the parsed tokens or trees to the user. No authentication or specialized runtime conditions are needed if the target system processes user-uploaded corpus packages or third-party NLP dataset repositories.

To prepare the exploit, an attacker creates a directory structure matching the expected YCOE layout. Instead of populating pos/ or psd/ with standard Old English corpus files, the attacker creates symbolic links pointing to target directories on the host filesystem:

malicious_ycoe/
├── psd/ -> /sandbox/nltk_data/private_corpora/secret_corpus/psd
└── pos/ -> /sandbox/nltk_data/private_corpora/secret_corpus/pos

When this directory structure is packaged (for example, within a TAR or ZIP archive that preserves symbolic links) and extracted on the target host, the symlinks resolve relative to the target environment. Because TaggedCorpusReader and YCOEParseCorpusReader filter files by suffix (.pos and .psd respectively) or when explicit documents parameters are passed to reader methods, any compatible files in the symlinked target directory become immediately readable.

The official NLTK regression test suite (nltk/test/unit/test_ycoe_streamview_pathsec.py) demonstrates this exact exploitation vector in a reproducible proof-of-concept:

import os
import shutil
import pytest
from nltk.corpus.reader.ycoe import YCOECorpusReader
 
def test_sibling_corpus_symlink_escape(pathsec_sandbox, monkeypatch):
    root, _ = pathsec_sandbox
    
    # 1. Create a legitimate YCOE corpus directory
    corpus = os.path.join(root, "ycoe")
    os.makedirs(os.path.join(corpus, "psd"), exist_ok=True)
    os.makedirs(os.path.join(corpus, "pos"), exist_ok=True)
    
    # 2. Create a separate target sibling corpus containing confidential tokens
    CANARY = "SECRET_TOKEN_EXFILTRATED"
    sibling = os.path.join(root, "other")
    os.makedirs(os.path.join(sibling, "pos"), exist_ok=True)
    with open(os.path.join(sibling, "pos", "secret.pos"), "w", encoding="utf-8") as f:
        f.write(f"Ic_PRO^N {CANARY}_VBP ._. cotest,1.1_ID\n")
        
    # 3. Replace the ycoe/pos directory with a symlink to the sibling directory
    shutil.rmtree(os.path.join(corpus, "pos"))
    os.symlink(os.path.join(sibling, "pos"), os.path.join(corpus, "pos"))
 
    # 4. In vulnerable versions (3.10.0 - 3.10.3), YCOECorpusReader traverses the symlink:
    reader = YCOECorpusReader(corpus)
    leaked_words = list(reader.words())
    assert CANARY in leaked_words

When reader.words() executes, YCOECorpusReader delegates the call to self._pos_reader.words(). The TaggedCorpusReader iterates over /path/to/other/pos/secret.pos, parses the SECRET_TOKEN_EXFILTRATED_VBP token, strips the part-of-speech tag (_VBP), and returns SECRET_TOKEN_EXFILTRATED in the output list.

The primary impact of CVE-2026-126304 is unauthorized disclosure of sensitive information stored on the filesystem (Confidentiality Impact: High). In multi-tenant machine learning environments, automated NLP grading platforms, or shared research sandboxes where NLTK processes untrusted corpus directories, an attacker can read proprietary datasets, sibling corpora, or sensitive text files residing within the NLTK data sandbox.

The vulnerability is scored at 8.7 (HIGH) under CVSS v4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). The Network (AV:N) attack vector and Low (AC:L) complexity reflect scenarios where corpus packages are ingested remotely over a network without requiring special runtime prerequisites (AT:N), privileges (PR:N), or user interaction (UI:N).

> [!NOTE] > While the vulnerability provides a reliable read-only file disclosure primitive (VC:H), it does not allow file modification (VI:N) or direct denial of service (VA:N), as the corpus readers only open files in read mode.

According to FIRST EPSS telemetry, CVE-2026-126304 has an exploitation probability score of 0.00522 (0.52%, 44.89th percentile) and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The scope of files readable via this flaw is bounded by OS-level filesystem permissions of the Python process and any global NLTK pathsec sandbox roots configured by the host environment.

The primary remediation for CVE-2026-126304 is to upgrade the nltk package to version 3.10.4 or later, which enforces canonical path containment checks via nltk.pathsec.validate_path during YCOECorpusReader initialization.

Administrators and developers can upgrade the package using pip:

pip install --upgrade "nltk>=3.10.4"

For environments where an immediate upgrade is not feasible, security teams should implement defense-in-depth controls around corpus ingestion and extraction:

1. Sanitize Extracted Archives: When extracting third-party or user-supplied corpus archives (.tar, .tar.gz, .zip), reject any archive members that are symbolic links (tarinfo.issym()) or hard links (tarinfo.islnk()). In Python 3.12 and later, always pass filter="data" to tarfile.TarFile.extractall(), which blocks symbolic links pointing outside the extraction root.
2. Pre-Validation of Corpus Directories: Before passing a directory path to YCOECorpusReader(root), explicitly verify that os.path.realpath(os.path.join(root, "psd")) and os.path.realpath(os.path.join(root, "pos")) start with os.path.realpath(root) + os.sep.
3. Enforce Strict Filesystem Permissions: Configure the OS user running the NLP pipeline with least-privilege read access, and ensure NLTK data directories (~/nltk_data, /usr/share/nltk_data) are owned by a privileged account with read-only permissions for worker processes.