CVE-2026-81727: NLTK before 3.10.3 Hardlink File Overwrite via downloader
Summary
NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink.
Details
- Vulnerability type: Filesystem containment bypass - Affected component: nltk.downloader.Downloader.download, nltk.downloader.Downloader.incrdownload - Affected versions: Published 3.9.4 and current source v3.10.0-rc2 both reproduced for the extraction-stage overwrite. - Patched versions: 3.10.3 - Root cause: The downloader validates traversal and symlink conditions but does not reject pre-existing hardlink aliases inside the install tree.
The install flow correctly rejects a pre-existing symlink at an extraction target, yet it accepts a pre-existing hardlink at the same path. When the package is installed, extracted member data is written through the hardlink and mutates the outside inode.
PoC
Preconditions - The attacker can plant files inside a writable shared downloader root on the same filesystem as the target file.
Steps 1. Prepare a downloader root and create a hardlink inside it that points to an outside target file. 2. Confirm a symlink at the same path is rejected as a negative control. 3. Run a normal Downloader.download() package install whose extracted member lands on the hardlink path. 4. Observe the outside target file is overwritten while the downloader still reports the package as installed.
Minimal reproducible excerpt
text extracthardlinkbefore ORIGINAL extracthardlinkafter PWNED extracthardlinkstatus installed
Impact
A shared or attacker-influenced downloader directory can be turned into an overwrite primitive against same-filesystem files outside the intended install root.
Remediation
Treat pre-existing hardlinks as unsafe in extraction targets, verify that each write path stays within the intended install tree at the inode level, and add regression tests that pair hardlinks with existing symlink controls.
Other sources
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incrdownload methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/nltkto a version that resolves this vulnerability.Fixed in 3.10.3 - Upgrade
Upgrade
nltk.downloader (Downloader.download, Downloader.incr_download)to a version that resolves this vulnerability.Fixed in 3.10.3
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments using an affected NLTK version where an attacker has write access to a shared downloader directory are exposed. The issue depends on the attacker being able to place pre-existing hardlinks in that directory.
What must an attacker do to exploit the vulnerability?
The attacker must create hardlinks in the shared downloader directory that point to files outside the intended install root. A subsequent normal package extraction through Downloader.download or Downloader.incr_download can overwrite those outside-root files.
Is exploitation remote or does it require local access?
The reported vector is local and requires low privileges. The attacker needs write access to the shared downloader directory; no user interaction is required.
How can I determine whether a deployment may be affected?
Check whether the installed NLTK version is earlier than 3.10.3 and whether Downloader.download or Downloader.incr_download extracts packages into a directory writable by untrusted users. Also review that directory for attacker-created hardlinks pointing outside the intended install tree.