CVE-2026-3087

MEDIUM

shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

Title source: cna
STIX 2.1

Description

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

References (7)

Scores

CVSS v4 6.0
EPSS 0.0006
EPSS Percentile 17.0%
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
Python Software Foundation/CPython
Python Software Foundation/CPython < 3.15.0
Published Apr 27, 2026
Tracked Since Apr 28, 2026