CVE-2026-3087

7.5 HIGH
Published: April 27, 2026 Modified: June 05, 2026
View on NVD

Description

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4
Source: cna@python.org
Patch
https://github.com/python/cpython/issues/146581
Source: cna@python.org
Exploit Issue Tracking Patch Vendor Advisory
https://github.com/python/cpython/pull/146591
Source: cna@python.org
Issue Tracking Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/
Source: cna@python.org
Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/28/9
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory

11 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.5 / 10.0
EPSS (Exploit Probability)
0.5%
41th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-22

Affected Vendors

microsoft python

Related CVEs

CVE-2026-48777 N/A
CVE-2026-47750 7.8
CVE-2026-47747 7.8
CVE-2026-46448 5.4
CVE-2026-22313 9.1