nltk: NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Down...
CVE-2026-81727 is fixed in nltk on 1 platform by DEBIAN-CVE-2026-81727 (version 3.10.3-1), released August 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| nltk · Debian 14 | 3.10.3-1 | DEBIAN-CVE-2026-81727 | Aug 28, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.