What’s Vulnerable › Vulnerabilities

CVE-2026-3087: shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-27 · updated 2026-10-26
• Weakness: CWE-22

Description

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

Affected products

• Python: through 3.14.4; 3.15.0-alpha1, 3.15.0-alpha2, 3.15.0-alpha3, 3.15.0-alpha4, 3.15.0-alpha5, 3.15.0-alpha6 (+2)

References

• https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8
• https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c
• https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d
• https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb
• https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94
• https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe
• https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840
• https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd
• https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19
• https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4
• https://github.com/python/cpython/issues/146581
• https://github.com/python/cpython/pull/146591

Get alerted when CVE-2026-3087 or the next vulnerability affects your stack