{"id":"GHSA-7r4r-6ppg-7ff8","kind":"vulnerability","aliases":["GHSA-7r4r-6ppg-7ff8"],"related":[],"title":"Duplicate Advisory: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-qg35-44qx-7vrr. This link is maintained to preserve external references.\n\n## Original Description\nNLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.","summary":"This advisory is a withdrawn duplicate of GHSA-qg35-44qx-7vrr. The original text says NLTK's YCOECorpusReader follows psd or pos directory symlinks, so a planted corpus can read files outside the corpus root inside the NLTK data sandbox.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nltk","fixed":[],"affected":"< 3.10.4","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-59","nltk","package","python"],"not_affected_if":["nltk-3.10.4-or-later","trusted-corpora-only"],"how_to_check":"- Run `pip show nltk` and compare the version with `3.10.4`.\n- Check whether code calls YCOECorpusReader on corpora you do not fully control.","fix":"- nltk: move to `3.10.4` or later (per the product range in this advisory).","status":"withdrawn","published_at":"2026-11-13T12:31:17+00:00","first_seen_at":"2026-11-13T20:59:21+00:00","triaged_at":"2026-11-13T21:00:18+00:00","updated_at":"2026-11-13T21:00:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T21:00:18Z","model":"claude-haiku-5-5","output":{"fix":"- nltk: move to `3.10.4` or later (per the product range in this advisory).","reach":"local","title":"NLTK: symlinked corpus directories let a reader pull files outside the corpus root","impact":"medium","summary":"This advisory is a withdrawn duplicate of GHSA-qg35-44qx-7vrr. The original text says NLTK's YCOECorpusReader follows psd or pos directory symlinks, so a planted corpus can read files outside the corpus root inside the NLTK data sandbox.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","nltk"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads arbitrary files the NLTK process can access","analyst_note":"Withdrawn duplicate; confirm details and fix status at GHSA-qg35-44qx-7vrr.","how_to_check":"- Run `pip show nltk` and compare the version with `3.10.4`.\n- Check whether code calls YCOECorpusReader on corpora you do not fully control.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-corpora-only","nltk-3.10.4-or-later"],"who_is_affected":"Applications that load YCOE corpora from untrusted or user-supplied locations through NLTK's YCOECorpusReader are exposed. Projects that only read their own bundled corpora can skip it. The advisory is withdrawn as a duplicate, so the live details sit in GHSA-qg35-44qx-7vrr.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000771,"input_tokens":4720,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-59':34B '3.10.0':109C '3.10.4':111C '44qx':48B,95C '6ppg':25A,30A '7ff8':26A,31A '7r4r':24A,29A '7vrr':49B,96C 'advisori':2A,39B,80C,82C 'allow':120C 'attack':121C,136C 'contain':112C 'content':150C 'control':137C 'corpora':153C 'corpus':16A,66B,72B,127C,140C 'cwe':33B 'data':20A,77B,160C 'descript':106C 'directori':10A,61B,134C 'duplic':1A,43B,79C,90C 'escap':4A,115C 'extern':103C 'file':13A,69B,124C,149C,156C 'follow':57B 'ghsa':23A,28A,46B,93C 'ghsa-7r4r-6ppg-7ff8':22A,27A 'ghsa-qg35-44qx-7vrr':45B,92C 'insid':74B 'let':7A 'link':98C 'maintain':100C 'make':142C 'nltk':32A,35B,54B,76B,107C,159C 'origin':51B,105C 'outsid':14A,70B,125C 'packag':36B 'pars':143C 'plant':65B,130C 'pos':60B,133C 'preserv':102C 'psd':58B,131C 'psd/pos':9A 'python':37B 'qg35':47B,94C 'read':12A,68B,123C 'refer':104C 'return':148C 'root':17A,73B,128C 'sandbox':21A,78B,161C 'say':53B 'sent':144C 'symlink':3A,11A,62B,114C,135C 'tag':146C 'temporari':155C 'text':52B 'vulner':116C 'withdrawn':42B,85C 'within':18A,157C 'word':147C 'ycoe':139C 'ycoecorpusread':6A,56B,118C","nicknames":[],"mitigations":[],"who_affected":"Applications that load YCOE corpora from untrusted or user-supplied locations through NLTK's YCOECorpusReader are exposed. Projects that only read their own bundled corpora can skip it. The advisory is withdrawn as a duplicate, so the live details sit in GHSA-qg35-44qx-7vrr.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nltk"],"ptokens":["nltk"],"labels":["cwe59","high","nltk","package","pypi","python"],"campaign_type":null,"search_a":"'6ppg':25A,30A '7ff8':26A,31A '7r4r':24A,29A 'advisori':2A 'corpus':16A 'data':20A 'directori':10A 'duplic':1A 'escap':4A 'file':13A 'ghsa':23A,28A 'ghsa-7r4r-6ppg-7ff8':22A,27A 'let':7A 'nltk':32A 'outsid':14A 'psd/pos':9A 'read':12A 'root':17A 'sandbox':21A 'symlink':3A,11A 'within':18A 'ycoecorpusread':6A","search_b":"'-59':34B '44qx':48B '7vrr':49B 'advisori':39B 'corpus':66B,72B 'cwe':33B 'data':77B 'directori':61B 'duplic':43B 'file':69B 'follow':57B 'ghsa':46B 'ghsa-qg35-44qx-7vrr':45B 'insid':74B 'nltk':35B,54B,76B 'origin':51B 'outsid':70B 'packag':36B 'plant':65B 'pos':60B 'psd':58B 'python':37B 'qg35':47B 'read':68B 'root':73B 'sandbox':78B 'say':53B 'symlink':62B 'text':52B 'withdrawn':42B 'ycoecorpusread':56B","search_c":"'3.10.0':109C '3.10.4':111C '44qx':95C '7vrr':96C 'advisori':80C,82C 'allow':120C 'attack':121C,136C 'contain':112C 'content':150C 'control':137C 'corpora':153C 'corpus':127C,140C 'data':160C 'descript':106C 'directori':134C 'duplic':79C,90C 'escap':115C 'extern':103C 'file':124C,149C,156C 'ghsa':93C 'ghsa-qg35-44qx-7vrr':92C 'link':98C 'maintain':100C 'make':142C 'nltk':107C,159C 'origin':105C 'outsid':125C 'pars':143C 'plant':130C 'pos':133C 'preserv':102C 'psd':131C 'qg35':94C 'read':123C 'refer':104C 'return':148C 'root':128C 'sandbox':161C 'sent':144C 'symlink':114C,135C 'tag':146C 'temporari':155C 'vulner':116C 'withdrawn':85C 'within':157C 'word':147C 'ycoe':139C 'ycoecorpusread':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T12:31:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7r4r-6ppg-7ff8","url":"https://github.com/advisories/GHSA-7r4r-6ppg-7ff8","severity":"high","published_at":"2026-11-13T12:31:17+00:00","modified_at":"2026-11-13T20:54:34+00:00","first_seen_at":"2026-11-13T20:59:21+00:00","fetched_at":"2026-11-13T20:59:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}