SZB-fad81d480b
EUVD-2026-67076: Path traversal flaw in NLTK through 3.10.3
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- nltk
- Product
- nltk
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-67076 (CVSS 8.3, published 2026-08-27) reports a path traversal vulnerability in NLTK through 3.10.3 model-artifact APIs. The entry says attackers can read or write files outside allowed sandbox roots.
If you use nltk
Upgrade nltk to a version newer than 3.10.3 once a fix is released
Avoid loading model artifacts from untrusted or caller-controlled paths
Review file access logs for reads or writes outside expected directories
What the sources say 1
· Mastodon: “NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths.” Source