CVE-2026-81727

Analyzed Analyzed - Analysis Complete

NLTK Filesystem Containment Bypass via Hardlink Attack

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81727

EUVD

EUVD-2026-67077

Affected Vendors & Products

Vendor	Product	Version / Range
nltk	nltk	to 3.10.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability in NLTK versions before 3.10.3 allows attackers to overwrite files outside the intended installation directory by exploiting hardlinks. The Downloader.download and Downloader.incr_download methods fail to block pre-existing hardlinks within the install tree, enabling file overwrites during package extraction.

Detection Guidance

Check for hardlinks in the NLTK downloader directory by running find /path/to/nltk/downloader -type l -ls. Monitor for unexpected file modifications outside the install tree during package installations.

Impact Analysis

An attacker with write access to a shared downloader directory can overwrite critical system files, leading to data corruption, loss, or potential system compromise. The attack requires low complexity and no user interaction, making it easier to exploit.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR and HIPAA by allowing unauthorized file overwrites outside the intended installation directory. Attackers could corrupt or modify sensitive data, leading to data integrity breaches or unauthorized access, which are critical violations under these regulations.

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later if available. Restrict write access to the downloader directory. Treat hardlinks as unsafe during extraction and verify write paths stay within the install tree.

Hi! I’m here to help you understand CVE-2026-81727. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70