THREAT OPS › Threat News › [NVD] CVE-2026-3087 (HIGH 7.5) — If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
[NVD] CVE-2026-3087 (HIGH 7.5) — If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
CVE-2026-3087 CVSS: 7.5 HIGH Published: 2026-04-27T21:16:42.480
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Indicators of compromise
- CVE-2026-3087cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-3087