{"id":"CVE-2026-3087","title":"If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\\\...`) then the archive will be extracted outside the target directory which is different than other operating systems","summary":"If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Window…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-22"],"vendor":"python","product":"python","affected":["python <= 3.14.4","python = 3.15.0"],"published":"2026-04-27","updated":"2026-08-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-3087","references":[{"url":"https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4","label":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/146581","label":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/146591","label":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/","label":"cna@python.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/28/9","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00551,"epssPercentile":0.44718,"ingestedAt":"2026-08-05T13:48:02.172Z","slug":"CVE-2026-3087","body":"## Overview\n\nIf `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.\n\n## Affected\n\n- `python <= 3.14.4`\n- `python = 3.15.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}