Symlink Bypass in NLTK FramenetCorpusReader Arbitrary File Read

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

NLTK (Natural Language Toolkit) versions before 3.10.2 contain a path traversal vulnerability in the FramenetCorpusReader component that allows attackers to bypass sandbox restrictions and read arbitrary XML files outside the intended corpus directory. The vulnerability exploits a weakness in path validation logic that fails to properly resolve symlinks—symbolic links placed within the corpus subdirectory with names containing no path separators pass validation checks but are resolved to files outside the corpus root when accessed through methods like frame_by_name(), _lu_file(), or doc(). This affects any application using vulnerable NLTK versions for processing FrameNet data, particularly those processing untrusted corpus inputs or running in shared environments where an attacker can place malicious symlinks. The high CVSS score of 7.5 reflects the direct information disclosure risk and the potential for sensitive data exposure through XML configuration files.

Casky's 351 matching skills leverage Claude's extended reasoning to detect the attack patterns mapped to MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners would identify suspicious patterns such as: abnormal corpus directory structure with symlink creation attempts preceding data access calls; unusual XML file reads originating from paths that don't match the declared corpus root; and NLTK method invocations (frame_by_name(), _lu_file(), doc()) receiving symlink-containing parameters. The skills analyze library behavior to flag path validation bypass attempts and symlink resolution chains that escape the intended sandbox boundary, enabling detection of reconnaissance activity (TA0007) as attackers probe for accessible files and initial exploitation attempts (TA0001) leveraging the corpus reader for unauthorized file access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-62384.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-62384

Casky has 351 skills that investigate the attack patterns behind CVE-2026-62384. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn