CVE-2026-3087

Опубликовано: 27 апр. 2026

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

If shutil.unpack_archive() is given a ZIP archive with an absolute Windows path containing a drive (C:\\...) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

Ссылки

https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c
Patch
https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb
Patch
https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94
Patch
https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840
Patch
https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd
Patch
https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19
Patch
https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4
Patch
https://github.com/python/cpython/issues/146581
Exploit
Issue Tracking
Patch
Vendor Advisory
https://github.com/python/cpython/pull/146591
Issue Tracking
Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/28/9
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Версия до 3.14.4 (включая)

cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*

cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*

cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*

cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*

cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*

cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*

cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*

cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 42%

0.00531

Низкий

7.5 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

CVE-2026-3087

CVSS3: 7.5

ubuntu

3 месяца назад

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

CVE-2026-3087

msrc

2 месяца назад

shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

CVE-2026-3087

CVSS3: 7.5

debian

3 месяца назад

If `shutil.unpack_archive()` is given a ZIP archive with an absolute W ...

GHSA-7r27-jhmm-vmp6

CVSS3: 7.5

github

3 месяца назад

EPSS

Процентиль: 42%

0.00531

Низкий

7.5 High

CVSS3

Дефекты

CWE-22