NLTK contains a file sandbox bypass vulnerability in several model-artifact APIs that use raw file operations on caller-controlled paths, bypassing path security enforcement. This allows reading or writing files outside of allowed root directories despite pathsec restrictions. The flaw affects versions from 3.7.0_7 up to but not including 3.8.1_3. A patch is available in version 3.8.1_3.