CVE-2026-81727 in NLTK
Riassunto
di MITRE • 27/08/2026
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.
If you want to get best quality of vulnerability data, you may have to visit VulDB.