CVE-2026-81727
HighCVSS 7.1Summary
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction.
Risk Assessment
An attacker can modify files outside the intended install tree, potentially leading to system integrity compromise or malicious code injection.
Recommendation
Update NLTK to version 3.10.3 or later, which contains the fix.
Original NVD description (English source)
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.