Medium [CVE-2026-62385] Information disclosure through path traversal

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state.

Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application. A flaw was found in NLTK.

This path traversal vulnerability, located in the FramenetCorpusReader and NKJPCorpusReader components, allows an attacker to read arbitrary XML files accessible to the application.

This can be achieved by supplying unsafe selectors or poisoned index state, exploiting methods such as `frame_by_name`, `doc`, `lu`, and `header` with specially crafted parameters. The primary consequence is information disclosure.

Successful exploitation requires an application to process specially crafted input through the vulnerable NLTK components. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Weakness: CWE-22. Red Hat lists Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI) as not affected.