PT-2026-35528 · Python · Cpython

Ggautomaton + 2 · Published 2026-04-27 · Updated 2026-04-29 · CVE-2026-3087

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CPython (affected versions not specified)

Description On Windows, the shutil.unpack archive() function fails to properly check for absolute paths within ZIP archives. If an archive contains a path with a drive letter (e.g., C:), files may be extracted outside of the intended target directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-LIBPYTHON-2026-3087

BIT-PYTHON-2026-3087

BIT-PYTHON-MIN-2026-3087

CVE-2026-3087

PSF-2026-22

Affected Products

Cpython

References · 18

• https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840 · Patch
• https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd · Patch
• https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4 · Patch
• https://github.com/python/cpython/issues/146581 · Vendor Advisory
• https://github.com/python/cpython/pull/146591 · Patch
• https://osv.dev/vulnerability/BIT-python-min-2026-3087 · Vendor Advisory
• https://mail.python.org/archives/list/[e-mail]/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-2026-3087 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3087 · Security Note
• https://osv.dev/vulnerability/BIT-libpython-2026-3087 · Vendor Advisory
• https://osv.dev/vulnerability/PSF-2026-22 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3087 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3087 · Security Note
• http://openwall.com/lists/oss-security/2026/04/28/9 · Note