CVE-2026-3087: shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
If shutil.unpackarchive() is given a ZIP archive with an absolute Windows path containing a drive (C:\\...) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Other sources
shutil.unpackarchive() doesn't check for Windows absolute paths in ZIPs
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3087?
CVE-2026-3087 is considered a moderate severity vulnerability due to the potential for extracting files outside the intended directory.
How do I fix CVE-2026-3087?
To fix CVE-2026-3087, ensure you are using a version of Python where this vulnerability has been patched or modify your code to validate the file paths before extraction.
What impact does CVE-2026-3087 have on my system?
CVE-2026-3087 can lead to unauthorized file access and potential system compromise if exploited by an attacker.
Which versions of Python are affected by CVE-2026-3087?
CVE-2026-3087 affects versions of Python that include the shutil.unpack_archive() function before the vulnerability was addressed.
How can I determine if my application is vulnerable to CVE-2026-3087?
Check if your application uses shutil.unpack_archive() to extract ZIP files with absolute Windows paths and review your Python version for related security patches.