Description

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-27T17:21:03.533Z",
  "pubdate": "2026-08-27T17:21:03.533Z",
  "executiveSummary": "NLTK versions prior to 3.10.3 are susceptible to a filesystem containment bypass vulnerability within the Downloader.download and Downloader.incr_download methods.\nThe vulnerability allows an attacker to achieve arbitrary file overwriting outside of the designated installation directory by leveraging pre-existing hardlinks.\nThe impact is significant, as it permits local privilege escalation or system state corruption if an attacker can manipulate files that the NLTK process has permission to overwrite.\nThis vulnerability specifically affects environments where the NLTK downloader directory is shared or accessible by untrusted users.\nExploitation requires an attacker to possess write access to the shared downloader directory, enabling them to plant malicious hardlinks that redirect file operations performed by the NLTK package extraction process.\nNo network-based exploitation is inherently required, as the attack vector is local; however, it poses a severe risk to multi-user systems or environments utilizing automated NLTK data fetching in shared workspaces.\nThe risk implication is unauthorized modification of host files, potentially leading to the replacement of executables, configuration files, or other sensitive system artifacts.",
  "technicalDetails": "The vulnerability originates from a failure in the NLTK Downloader's extraction logic to validate the integrity of file paths during package installation. Specifically, the Downloader.download and Downloader.incr_download methods process downloaded archives without verifying if the target destination has been tampered with via filesystem-level primitives, such as hardlinks.\nThe root cause is an insecure assumption that files extracted to the downloader directory are strictly contained within that directory's tree. Because the library does not verify whether a destination file is a symbolic link or a hardlink pointing to an arbitrary location on the filesystem, it inadvertently follows these links during the writing process.\nThe attack flow proceeds as follows: 1. An attacker with local access to the NLTK downloader directory identifies a target file they wish to overwrite (e.g., a system configuration file or a script executed with elevated privileges). 2. The attacker creates a hardlink within the downloader directory that points to the target file outside the intended root. 3. The attacker then triggers a download or update operation within NLTK that involves extracting a package that includes a file name matching the name of the created hardlink. 4. When NLTK's Downloader method processes the archive, it attempts to write the package content to the destination path. Because the destination is a hardlink, the operating system's kernel resolves the link and directs the write operation to the original file's inode instead of a new file within the downloader tree.\nThis behavior results in the arbitrary overwriting of files outside the intended installation path. The vulnerability does not require authentication to the NLTK application itself; it relies on the filesystem-level permissions of the user account running the NLTK process. If the NLTK process runs with administrative or root privileges, the impact of this bypass is escalated, allowing for arbitrary code execution through the overwriting of sensitive binaries or libraries. The exploitation is transparent to the end-user or the automated NLTK task, as the file write operation proceeds as if it were a legitimate part of the installation process. The lack of path canonicalization checks—specifically failing to detect if the target path resolves to a location outside the base directory—renders the Downloader component vulnerable in any environment where the download directory is not strictly isolated from other users."
}