https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T02:14:51.099293+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-3087 CVE-2026-3087 — shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs 2026-10-03T02:14:51.100383+00:00

Affected: Python Software Foundation CPython

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.