CVE-2026-81727 in NLTK
요약
\~에 의해 MITRE • 2026. 08. 27.
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.
If you want to get best quality of vulnerability data, you may have to visit VulDB.