Path Traversal Vulnerability in NLTK Model-Artifact APIs by NLTK
CVE-2026-81726

8.3HIGH

Key Information:

Vendor

Nltk

Status
Nltk
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81726?

NLTK versions up to 3.10.3 are affected by a path traversal vulnerability that compromises the security of the model-artifact APIs. This vulnerability allows attackers to perform unauthorized file read and write operations, bypassing the path security enforcement by utilizing raw file operations on user-controlled paths. As a result, malicious actors can access files outside defined sandbox limits through specific APIs like TransitionParser, AveragedPerceptron, and PerceptronTagger when pathsec is active. It is crucial for users to update their NLTK installations to protect against potential exploitation.

Affected Version(s)

nltk 0 <= 3.10.3

References

https://github.com/nltk/nltk/security/advisories/GHSA-8mg...
vendor-advisory
https://www.vulncheck.com/advisories/nltk-through-3.10.3-...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.