CVE-2026-81726 HIGH

CVE-2026-81726: NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

Vendor Nltk

Product nltk

Weakness CWE-73

Published August 27, 2026

Last update August 27, 2026

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

Key dates

02Disclosure timeline

August 27, 2026 CVE published

August 27, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-81726 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/73.html AskarLabs — CWE-73 write-up External Control of File Name or Path

Related vulnerabilities

04Related CVE

CVE-2025-6463 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion CVE-2023-4634 Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution CVE-2025-10494 Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2023-5816 Code Explorer <= 1.4.5 - Authenticated (Admin+) External File Reading CVE-2025-4603 eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion