Medium [CVE-2026-62383] Information disclosure via symlink in IPIPANCorpusReader
This medium-severity Red Hat Linux advisory covers CVE-2026-62383.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely.
Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename. A flaw was found in nltk.
A local attacker can exploit a symlink-based vulnerability in the IPIPANCorpusReader methods. By placing a symbolic link in the corpus root directory and invoking specific methods, an attacker can bypass security validation and read arbitrary files accessible to the process.
This could lead to unauthorized information disclosure. The `nltk` library is vulnerable to information disclosure, allowing an attacker with local access and low privileges to read arbitrary files.
This occurs if an attacker can place a symlink within the `nltk` corpus root directory, bypassing path validation and enabling access to sensitive data with the permissions of the running process. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Weakness: CWE-22. Red Hat lists Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI) as not affected.
- < 3.10.2
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Mitigation checklist
- To mitigate this vulnerability, restrict write access to the `IPIPANCorpusReader` corpus root directory. Ensure that only trusted users or processes have permissions to create or modify files within this directory. This prevents an attacker from placing malicious symlinks that could lead to arbitrary file disclosure.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.