CVE-2026-81726

NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

Affected

nltk

CVSS v4.0 VULNCHECK

8.3 HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v4.0 GitHub

8.3 HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS v3.1 VULNCHECK

7.0 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS

0.26% chance of exploitation in the next 30 days, 17th percentile

Published

2026-08-27

Proof-of-concept exploits (1)

• advisories/GHSA-8mgp-746c-j5xp

References

• CVE Record
• NVD entry