---
id: "GHSA-7r4r-6ppg-7ff8"
page: "https://infrastack.ai/live/GHSA-7r4r-6ppg-7ff8"
kind: "vulnerability"
aliases: ["GHSA-7r4r-6ppg-7ff8"]
title: "Duplicate Advisory: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "nltk", "fixed": [], "affected": "< 3.10.4", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-59", "nltk", "package", "python"]
not_affected_if: ["nltk-3.10.4-or-later", "trusted-corpora-only"]
published_at: "2026-11-13T12:31:17+00:00"
first_seen_at: "2026-11-13T20:59:21+00:00"
updated_at: "2026-11-13T21:00:18+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-7r4r-6ppg-7ff8", "first_seen_at": "2026-11-13T20:59:21+00:00"}]
exploit_sources: []
---

# Duplicate Advisory: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox

Link for people: https://infrastack.ai/live/GHSA-7r4r-6ppg-7ff8 (this .md is for agents)

This advisory is a withdrawn duplicate of GHSA-qg35-44qx-7vrr. The original text says NLTK's YCOECorpusReader follows psd or pos directory symlinks, so a planted corpus can read files outside the corpus root inside the NLTK data sandbox.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:nltk affected < 3.10.4 fixed no fixed version listed

## How to check

- Run `pip show nltk` and compare the version with `3.10.4`.
- Check whether code calls YCOECorpusReader on corpora you do not fully control.

## Fix

- nltk: move to `3.10.4` or later (per the product range in this advisory).

## Timeline

- 2026-11-13T20:59:21+00:00 ghsa https://github.com/advisories/GHSA-7r4r-6ppg-7ff8

## From the sources

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-qg35-44qx-7vrr. This link is maintained to preserve external references.

## Original Description
NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_