CVE-2026-3087
Full vulnerability record from the local CVENow database.
Description
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Severity
MEDIUM
CVSS score
6.0
(v4.0)
Vulnerability status
Modified
Source identifier
Published
2026-04-27 21:16:42.480000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-3087",
"sourceIdentifier": "[email protected]",
"published": "2026-04-27T21:16:42.480",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability."
},
{
"lang": "es",
"value": "Si a shutil.unpack_archive() se le proporciona un archivo ZIP con una ruta absoluta de Windows que contiene una unidad (C:\\\\...), entonces el archivo se extraerá fuera del directorio de destino, lo cual es diferente a otros sistemas operativos. Solo Windows se ve afectado por esta vulnerabilidad."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Python Software Foundation",
"product": "CPython",
"defaultStatus": "unaffected",
"modules": [
"shutil"
],
"repo": "https://github.com/python/cpython",
"versions": [
{
"version": "0",
"lessThan": "3.10.21",
"versionType": "python",
"status": "affected"
},
{
"version": "3.11.0",
"lessThan": "3.11.16",
"versionType": "python",
"status": "affected"
},
{
"version": "3.12.0",
"lessThan": "3.12.14",
"versionType": "python",
"status": "affected"
},
{
"version": "3.13.0",
"lessThan": "3.13.14",
"versionType": "python",
"status": "affected"
},
{
"version": "3.14.0a1",
"lessThan": "3.14.5rc1",
"versionType": "python",
"status": "affected"
},
{
"version": "3.15.0a1",
"lessThan": "3.15.0b1",
"versionType": "python",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-28T13:38:08.747185Z",
"id": "CVE-2026-3087",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.14.4",
"matchCriteriaId": "8DA90507-80E6-4412-BBC7-F4D17DF6BCD7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A3327507-0B1D-4F28-A983-D07A2C8A7696"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "C8AF17F1-A27F-4C98-BA5A-B4319710E8D1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*",
"matchCriteriaId": "24CF56B0-2F4E-42A2-B655-F493AA0A4815"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*",
"matchCriteriaId": "7184ABBA-B100-489E-B5C1-1C9EEC0546CA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*",
"matchCriteriaId": "B6D4181B-3E1B-499B-AAB1-50868A6A6AD3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*",
"matchCriteriaId": "A52F6DD2-717D-4E8C-8DB7-00890BC1ABAE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*",
"matchCriteriaId": "8C46C55C-801E-4F86-B669-8E6A12B4AB6F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*",
"matchCriteriaId": "5A8DF8E5-61F9-4899-BF40-41A17E223441"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/python/cpython/issues/146581",
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking",
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://github.com/python/cpython/pull/146591",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://mail.python.org/archives/list/[email protected]/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/",
"source": "[email protected]",
"tags": [
"Mailing List",
"Vendor Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/9",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
}
]
}