8.3
High
CVE-2026-81726 NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by…
Description
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| nltk 3.10 | earliest → 3.10.3 | 3.10.4 |
References
Timeline
- Published
- Last modified
Other CVEs of nltk
The 36 CVEs of nltk →
CVE-2026-109956
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass…
8.3
High
CVE-2026-81727
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and…
6.9
Medium
CVE-2026-81725
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows…
6.3
Medium
CVE-2026-81724
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows…
6.9
Medium