VULNERABILITY INTELLIGENCE

CVE-2026-81726

CVSS score8.3 HIGH
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-08-27
Last modified2026-10-30
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Description

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

Weakness classification

  • CWE-73: External Control of File Name or Path

Primary references