SB2026081839 - Path traversal in Natural Language Toolkit

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081839

SB2026081839 - Path traversal in Natural Language Toolkit

Published: August 18, 2026

Security Bulletin ID SB2026081839
CSH Severity
Medium
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read or overwrite files outside allowed roots.

The vulnerability exists due to external control of file name or path in model-artifact APIs when handling caller-controlled model import or export paths. A remote attacker can provide a crafted path to read or overwrite files outside allowed roots.

Exploitation requires an application to enable path security enforcement and allow untrusted workflows to choose model import or export paths.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References