CVE-2026-81727
Fixed in a distro release EPSS <1%CVSS 7.1
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.
Products: nltk
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | nltk | 3.10.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | nemo | 2.7.3-r27 |
| Chainguard | open-webui | 0.11.3-r1 |
| Debian 12 | nltk | no fix |
| Debian 13 | nltk | no fix |
| Debian 14 | nltk | 3.10.3-1 |
| Ubuntu Pro 14.04 LTS | nltk | no fix |
| Ubuntu Pro 16.04 LTS | nltk | no fix |
| Ubuntu Pro 18.04 LTS | nltk | no fix |
| Ubuntu Pro 20.04 LTS | nltk | no fix |
| Ubuntu Pro 22.04 LTS | nltk | no fix |
| Ubuntu Pro 24.04 LTS | nltk | no fix |
| Ubuntu Pro 26.04 LTS | nltk | no fix |
| Wolfi | open-webui | 0.11.3-r1 |