CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability (CWE-73, external control of file name or path) in its model-artifact APIs, which perform raw file operations on caller-controlled paths. This bypasses the pathsec sandbox enforcement: when pathsec is enabled, calls made through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs can still touch files outside the allowed sandbox roots if those APIs receive attacker-controlled path arguments. An attacker who can influence those paths gains the ability to read or write files outside the intended sandbox root on the host running NLTK, limited by the service's filesystem permissions. Any application or service running a vulnerable NLTK version, with pathsec sandboxing enabled and user-supplied paths passed to the listed APIs, is affected, while offline research or teaching use is largely unexposed. A public advisory (GHSA-8mgp-746c-j5xp) exists, but there are no confirmed in-the-wild exploits: the flaw is not in CISA KEV and EPSS assigns a roughly 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade NLTK to the first fixed release published after 3.10.3, checking the GitHub advisory GHSA-8mgp-746c-j5xp for the patched version. Until patched, avoid passing untrusted or user-controlled paths to TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs, and validate/normalize paths against the intended sandbox root. Given low EPSS (0.3%) and no KEV listing, prioritize patching for network-facing services that use these APIs with pathsec enabled.