CVE-2026-81726NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

Descripción

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-8mgp-746c-j5xp) vendor-advisoryExploitVendor Advisory
• VulnCheck Advisory: NLTK through 3.10.3 Path Traversal via Model-Artifact APIs third-party-advisoryThird Party Advisory