CVE Feed

    Dashboard / CVE / CVE-2026-3087

    CVE-2026-3087

    If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

    Published:Apr 27, 2026
    Last Modified:Aug 10, 2026
    EPS:Apr 27, 2026
    EPSS Score:0.00551
    CVSS Score:7.5

    Affected Products

    Vendor
    Microsoft
    Product
    Windows
    Vendor
    Python
    Product
    Cpython
    Vendor
    Python
    Product
    Python

    Exploits

    https://github.com/python/cpython/issues/146581

    Related CVEs

    CVE-2026-87602 (CVSS 4.7) — Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to…
    CVE-2026-87509 (CVSS 8.1) — Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attac…
    CVE-2026-87618 (CVSS 8.3) — Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remo…
    CVE-2026-87653 (CVSS 5.4) — UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote atta…
    CVE-2026-87528 (CVSS 9.6) — Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to pote…
    CVE-2026-87644 (CVSS 8.3) — Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attack…
    CVE-2026-87616 (CVSS 8.3) — Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attack…
    CVE-2026-87454 (CVSS 6.5) — Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker…
    CVE-2026-87494 (CVSS 9.6) — Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leve…
    CVE-2026-87530 (CVSS 8.1) — Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 a…

    References

    https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8
    https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c
    https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d
    https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb
    https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94
    https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe
    https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840
    https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd
    https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19
    https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4
    https://github.com/python/cpython/issues/146581
    https://github.com/python/cpython/pull/146591
    https://mail.python.org/archives/list/[email protected]/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/
    http://www.openwall.com/lists/oss-security/2026/04/28/9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High