Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-3087

25
FAUCET Score

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

First published: Apr 27, 2026Last modified: Jun 10, 2026

Impacted Technologies

VendorProductVersion(s)CPE
>= 0, < 3.13.14CPE match
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
<= 3.14.4CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
3.15.0CPE matchmatch criteria
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
3.15.0CPE matchmatch criteria
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
3.15.0CPE matchmatch criteria
cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

6.0MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
HIGH
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.53%
Probability of exploitation in next 30 days
EPSS Percentile
41.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0053 is in the 19th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

github_advisorypatch availablevia nvd_reference
View patch

Vendor Advisories (1)

microsoft2026-Apr/CVE-2026-3087Moderate

shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

Apr 14, 2026

References

openwall.com / lists/oss-security/2026/04/28/9
Mailing ListThird Party Advisory
github.com / python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c
Patch
github.com / python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb
Patch
github.com / python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94
Patch
github.com / python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840
Patch
github.com / python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd
Patch
github.com / python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19
Patch
github.com / python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4
Patch
github.com / python/cpython/issues/146581
ExploitIssue TrackingPatchVendor Advisory
github.com / python/cpython/pull/146591
Issue TrackingPatch
mail.python.org / archives/list/[email protected]/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4
Mailing ListVendor Advisory