CVE-2026-81726NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

Açıklama

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-8mgp-746c-j5xp) vendor-advisoryExploitVendor Advisory
• VulnCheck Advisory: NLTK through 3.10.3 Path Traversal via Model-Artifact APIs third-party-advisoryThird Party Advisory