Vulnerability · Published Apr 27, 2026 · Assigned by PSF
CVE-2026-3087shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
Medium 6.0
In plain English
A medium-severity path traversal in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | python3.10 | no fix listed | UBUNTU-CVE-2026-3087 |
| Ubuntu:24.04:LTS | python3.12 | no fix listed | UBUNTU-CVE-2026-3087 |
| Ubuntu:25.10 | python3.13 | no fix listed | UBUNTU-CVE-2026-3087 |
| Ubuntu:25.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-3087 |
| Ubuntu:26.04:LTS | python3.14 | no fix listed | UBUNTU-CVE-2026-3087 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.213.11.0 – before 3.11.163.12.0 – before 3.12.143.13.0 – before 3.13.143.14.0a1 – before 3.14.5rc13.15.0a1 – before 3.15.0b1 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/pull/146591 patch
- https://github.com/python/cpython/issues/146581 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/ vendor-advisory
- https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840 patch
- https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd patch
- https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4 patch
- https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c patch
- https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb patch
- https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94 patch
- https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19 patch
- https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe patch
- https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d patch
- https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8 patch
- http://www.openwall.com/lists/oss-security/2026/04/28/9