CVE-2026-3087
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Schwachstellenklasse
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Betroffene Produkte
- python python
- microsoft windows
Quellen
- https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8
- https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c
- https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d
- https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb
- https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94
- https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.