p PatchFirst

CVE-2026-3087

CVE-2026-3087 · shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

CVSS 6.0 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • python

    Versions
    • ≥ 0, < 3.10.21: Affected (python)
    • ≥ 3.11.0, < 3.11.16: Affected (python)
    • ≥ 3.12.0, < 3.12.14: Affected (python)
    • ≥ 3.13.0, < 3.13.14: Affected (python)
    • ≥ 3.14.0a1, < 3.14.5rc1: Affected (python)
    • ≥ 3.15.0a1, < 3.15.0b1: Affected (python)

    Update to 3.10.21; Update to 3.11.16; Update to 3.12.14; Update to 3.13.14; Update to 3.14.5rc1; Update to 3.15.0b1

Original sources

Check your server →