HIGH 8.3 NVD
CVE-2026-81726
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-contro
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.
References
- https://github.com/nltk/nltk/security/advisories/GHSA-8mgp-746c-j5xp
- https://www.vulncheck.com/advisories/nltk-through-3.10.3-path-traversal-via-model-artifact
- https://github.com/nltk/nltk/security/advisories/GHSA-8mgp-746c-j5xp
This high severity vulnerability with a CVSS score of 8.3 was published on 2026-08-27 via NVD.
vulnfeed aggregates 11337 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.