NLTK EUVD-2026-65526

Exploitation requires the attacker to have write access to at least one NLTK trusted corpus data root directory in order to stage a crafted symbolic link - this is the decisive prerequisite. This condition exists in shared or multi-tenant environments where corpus directories are group-writable, where an unprivileged process can populate corpus directories (e.g., automated corpus download pipelines with insufficient permission isolation), or where corpus data is sourced from an untrusted network location. Once the symlink is planted, exploitation is triggered simply by invoking the affected corpus reader methods (channels(), domains(), synonyms()) - no privileged user interaction is required at trigger time. Deployments where the NLTK corpus directory is owned exclusively by the NLTK service account and is not writable by any other user or process are not exploitable. The read-disclosure impact is bounded by what files the NLTK process user can access on the host filesystem.

The CVSS 4.0 score of 8.2 reflects high confidentiality impact with a network attack vector, but the AT:P (Attack Target: Presence) metric and AC:H signal that specific prerequisites - pre-staged symlinked corpus files - must be satisfied before exploitation can occur. No CISA KEV listing exists and no public exploit code has been identified, reducing urgency compared to a fully weaponized vulnerability at this score. EPSS data was not provided, leaving probabilistic exploitation frequency unquantified. Real-world risk scales directly with how exposed the corpus directory is: automated ML pipelines, shared academic clusters, or multi-tenant NLP platforms where corpus directories are writable by lower-privileged processes represent materially elevated risk. Single-user or tightly access-controlled deployments where the corpus directory is owned exclusively by the NLTK service account face substantially lower practical risk. The absence of active exploitation and the need for write-path access keep this below emergency priority for most operators, but the confidentiality impact is severe when prerequisites are met.

An attacker with write access to a shared NLTK corpus directory - for example, a low-privileged user on a multi-tenant NLP research server - creates a symbolic link inside the corpus folder pointing to a sensitive file outside the root, such as an application secrets file or /etc/shadow. When a legitimate downstream process invokes a corpus reader method such as synonyms() on that corpus, NLTK's affected reader calls Python's built-in open() on the symlink path, transparently follows the link, and returns the target file's contents to the caller. No public exploit code has been identified at time of analysis.