CVE-2026-3087

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

• CWE-22

• https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8
• https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8cPatch
• https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d
• https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cbPatch
• https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94Patch
• https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe
• https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840Patch
• https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fdPatch
• https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19Patch
• https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4Patch
• https://github.com/python/cpython/issues/146581Exploit, Issue Tracking, Patch, Vendor Advisory
• https://github.com/python/cpython/pull/146591Issue Tracking, Patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/04/28/9Mailing List, Third Party Advisory

Published

Apr 27, 2026

Last Modified

Aug 13, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30861WeKnora is an LLM-powered framework designed for deep docume…8.8
• CVE-2026-30862Appsmith is a platform to build admin panels, internal tools…9
• CVE-2026-30863Parse Server is an open source backend that can be deployed …9.8
• CVE-2026-30867CocoaMQTT is a MQTT 5.0 client library for iOS and macOS wri…6.5
• CVE-2026-30868OPNsense is a FreeBSD based firewall and routing platform. P…8.1
• CVE-2026-30869SiYuan is a personal knowledge management system. Prior to 3…9.8
• CVE-2026-30870PowerSync Service is the server-side component of the PowerS…6.5
• CVE-2026-30871OpenWrt Project is a Linux operating system targeting embedd…9.8
• CVE-2026-30872OpenWrt Project is a Linux operating system targeting embedd…9.8
• CVE-2026-30873OpenWrt Project is a Linux operating system targeting embedd…4.9
• CVE-2026-30874OpenWrt Project is a Linux operating system targeting embedd…7.8
• CVE-2026-30875Chamilo LMS is a learning management system. Prior to versio…8.8