CVE-2026-81726NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

Beschreibung

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-8mgp-746c-j5xp) vendor-advisoryExploitVendor Advisory
• VulnCheck Advisory: NLTK through 3.10.3 Path Traversal via Model-Artifact APIs third-party-advisoryThird Party Advisory