https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:50:20.929373+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-libpython-2026-3087 BIT-libpython-2026-3087 — shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs 2026-10-02T19:50:21.012872+00:00

Affected: Bitnami: libpython

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0505 certfr-2026-avi-0505 — Une vulnérabilité a été découverte dans Python. Elle permet à un attaquant de provoquer un contournement de la politiqu… 2026-10-02T19:50:21.012925+00:00 certfr-2026-avi-0505 https://cve.radiocsirt.org/vuln/euvd-2026-351829 EUVD-2026-351829 2026-10-02T19:50:21.012945+00:00 EUVD-2026-351829 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3087 fkie_cve-2026-3087 2026-10-02T19:50:21.012959+00:00

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-7r27-jhmm-vmp6 GHSA-7r27-jhmm-vmp6 2026-10-02T19:50:21.012981+00:00

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-3087 msrc_CVE-2026-3087 — shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs 2026-10-02T19:50:21.012996+00:00 msrc_CVE-2026-3087 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-3087 Withdrawn: UBUNTU-CVE-2026-3087 2026-10-02T19:50:21.013011+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 9 more

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.