CVE catalog
CVE-2026-3087
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than
- Severity
- Medium · CVSS 6
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.55% · Oct 25, 2026
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | pypy3 | sid | 8.0.1+dfsg-1 | not affected |
| Debian | pypy3 | forky | 8.0.1+dfsg-1 | not affected |
| Debian | pypy3 | trixie | 7.3.19+dfsg-2 | not affected |
| Debian | pypy3 | bookworm | 7.3.11+dfsg-2+deb12u3 | not affected |
| Debian | python3.11 | bookworm | 3.11.2-6+deb12u8 | not affected |
| Debian | python3.11 | bookworm-security | 3.11.2-6+deb12u9 | not affected |
| Cpe | python | Not reported | Not reported | unknown |
| Cpe | python3.11 | Not reported | Not reported | not affected |
| Cpe | python | Not reported | Not reported | unknown |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | pypy3 | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | pypy3 | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | pypy3 | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | pypy3 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Debian | python3.11 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [idle-python3.11]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· all · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· all · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [libpython3.11]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [libpython3.11-dbg]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [libpython3.11-dev]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [libpython3.11-minimal]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [libpython3.11-stdlib]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [libpython3.11-testsuite]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· all · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· all · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [pypy3]Not affected
Details (2)
7.3.11+dfsg-2+deb12u3· amd64 · bookwormNot affected
nvd · pypy3 · debian · bookworm
7.3.11+dfsg-2+deb12u3· arm64 · bookwormNot affected
nvd · pypy3 · debian · bookworm
- [pypy3-dev]Not affected
Source package: [pypy3]
Details (2)
7.3.11+dfsg-2+deb12u3· all · bookwormNot affected
nvd · pypy3 · debian · bookworm
7.3.11+dfsg-2+deb12u3· all · bookwormNot affected
nvd · pypy3 · debian · bookworm
- [pypy3-doc]Not affected
Source package: [pypy3]
Details (2)
7.3.11+dfsg-2+deb12u3· all · bookwormNot affected
nvd · pypy3 · debian · bookworm
7.3.11+dfsg-2+deb12u3· all · bookwormNot affected
nvd · pypy3 · debian · bookworm
- [pypy3-lib]Not affected
Source package: [pypy3]
Details (2)
7.3.11+dfsg-2+deb12u3· amd64 · bookwormNot affected
nvd · pypy3 · debian · bookworm
7.3.11+dfsg-2+deb12u3· arm64 · bookwormNot affected
nvd · pypy3 · debian · bookworm
- [pypy3-lib-testsuite]Not affected
Source package: [pypy3]
Details (2)
7.3.11+dfsg-2+deb12u3· all · bookwormNot affected
nvd · pypy3 · debian · bookworm
7.3.11+dfsg-2+deb12u3· all · bookwormNot affected
nvd · pypy3 · debian · bookworm
- [pypy3-tk]Not affected
Source package: [pypy3]
Details (2)
7.3.11+dfsg-2+deb12u3· amd64 · bookwormNot affected
nvd · pypy3 · debian · bookworm
7.3.11+dfsg-2+deb12u3· arm64 · bookwormNot affected
nvd · pypy3 · debian · bookworm
- [pypy3-venv]Not affected
Source package: [pypy3]
Details (2)
7.3.11+dfsg-2+deb12u3· all · bookwormNot affected
nvd · pypy3 · debian · bookworm
7.3.11+dfsg-2+deb12u3· all · bookwormNot affected
nvd · pypy3 · debian · bookworm
- [python3.11]Not affected
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [python3.11-dbg]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [python3.11-dev]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [python3.11-doc]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· all · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· all · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [python3.11-examples]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· all · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· all · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
- [python3.11-full]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
nvd · python3.11 · debian · bookworm
Observed:
References
- [http://www.openwall.com/lists/oss-security/2026/04/28/9]
- [https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8]
- [https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c]
- [https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d]
- [https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb]
- [https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94]
- [https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe]
- [https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840]
- [https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd]
- [https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19]
- [https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4]
- [https://github.com/python/cpython/issues/146581]
- [https://github.com/python/cpython/pull/146591]
- [https://mail.python.org/archives/list/security-announce@python.org/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-3087]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-3087]
- [https://security-tracker.debian.org/tracker/CVE-2026-3087]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]