CVE-2026-81727

NLTK (Natural Language Toolkit) versions before 3.10.3 contain a filesystem containment bypass (CWE-59, link following) in the Downloader.download and Downloader.incr_download methods. An attacker who can write to a shared NLTK downloader directory can pre-create hardlinks that point to files outside the install root; when the downloader later extracts or rewrites package files, it follows those hardlinks and overwrites the outside-root targets instead of staying inside the install tree. The attacker gains high-impact integrity and availability modification of files outside the intended install directory (per the CVSS 4.0 score of 6.9, with no confidentiality impact), which can tamper with or corrupt files the NLTK process has permission to write. Any environment where the NLTK data/downloader directory is shared and writable by other local users or tenants, such as multi-user servers, shared containers, or CI runners, is affected, while single-user installs with private data directories face little risk. There is no known in-the-wild exploitation: the issue is not in CISA KEV, EPSS estimates a 0.1% 30-day exploitation probability (3rd percentile), and a public writeup exists in NLTK's GitHub security advisory GHSA-f794-5jv7-7672.

What to do: Upgrade NLTK to 3.10.3 or later, which resolves the Downloader containment bypass. Until patched, restrict write access to the NLTK data/downloader directory to trusted users, avoid sharing a single downloader directory across users or tenants, and be aware that hardlink-capable shared filesystems (multi-user servers, containers, CI) are the main risk scenario.