CVE-2026-3087shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
Updated under an hour ago ()
Does this affect you?
It affects Python Software Foundation CPython and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
- CVSS
- 6.0 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- PSF
- NVD analysis
- Modified
- Record last updated
- Aug 12, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Python Software Foundation CPython python_software_foundation:cpython (from the name) | before 3.10.21; from 3.11.0 before 3.11.16; from 3.12.0 before 3.12.14; from 3.13.0 before 3.13.14; from 3.14.0a1 before 3.14.5rc1; from 3.15.0a1 before 3.15.0b1 | CNA record |
python python python:python | through 3.14.4; 3.15.0; 3.15.0; 3.15.0; 3.15.0; 3.15.0; 3.15.0; 3.15.0; and 1 more ranges | NVD |
References
- https://github.com/python/cpython/pull/146591patch, issue-tracking
- https://github.com/python/cpython/issues/146581issue-tracking, exploit, patch, vendor-advisory
- https://mail.python.org/archives/list/security-announce@python.org/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/vendor-advisory, mailing-list
- https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840patch
- https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fdpatch
- https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4patch
- https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8cpatch
- https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cbpatch
- https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94patch
- https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19patch
- https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefepatch
- https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4dpatch
- https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8patch
- http://www.openwall.com/lists/oss-security/2026/04/28/9mailing-list, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.