CVE-2026-3087

HIGH

shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

Title source: cna
STIX 2.1

Description

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

References (11)

Core 11
Core References
Issue Tracking issue-tracking
https://github.com/python/cpython/issues/146581

Scores

CVSS v3 7.5
EPSS 0.0053
EPSS Percentile 40.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (9)
python/python 3.15.0 alpha_1 (16 CPE variants)
python/python < 3.14.4
Python Software Foundation/CPython
Python Software Foundation/CPython < 3.13.14
Python Software Foundation/CPython < 3.14.5rc1
Python Software Foundation/CPython < 3.15.0
Python Software Foundation/CPython 3.14.0a1 - 3.14.5rc1
Python Software Foundation/CPython 3.15.0a1 - 3.15.0
Python Software Foundation/CPython 3.15.0a1 - 3.15.0b1
Published Apr 27, 2026
Tracked Since Apr 28, 2026