CyberRota Analysis
AI-GeneratedThe vulnerability allows attackers to exploit model-artifact APIs in NLTK versions up to 3.10.3, enabling unauthorized file read and write operations outside designated sandbox directories due to insufficient path security enforcement. This poses a significant risk as it can lead to data leakage or manipulation within applications utilizing these APIs. Organizations using NLTK for natural language processing should prioritize patching this vulnerability to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.
Related CVEs
Other vulnerabilities affecting the same vendor(s)