Dashboard / CVE-2026-81726

CVE-2026-81726

HIGH
MEDIUM Priority: 0.03 BB Relevance: 67/100
Published: 2026-08-27 Modified: 2026-10-30 First seen: 2026-10-30 Status: active

Attack Surface

Network No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: X
AT: Present
VC: High
VI: Low
VA: Low

Description

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
nltk nltk 0
nltk nltk < 3.10.3

References & Advisories (2)

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

8.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.34%
Raw Score 0.003390
Percentile 27.4%
Date 2026-10-30

EPSS Trend

2026-10-30
0.00339
2026-10-29
0.00339

Intelligence Sources

mitre ref →
nvd ref →

External Links