CVE-2026-3087

Katalog CVE

CVSS 7.5 · High EPSS 0,73%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada python. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

Rincian

Terbit di NVD

27 April 2026

Terakhir diubah

13 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/python/cpython/issues/146581 exploit · issue tracking · patch · advisory vendor
• https://mail.python.org/archives/list/security-announce@python.org/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/ mailing list · advisory vendor
• https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c patch
• https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb patch
• https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94 patch
• https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840 patch
• https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd patch
• https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19 patch
• https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4 patch
• https://github.com/python/cpython/pull/146591 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2026/04/28/9 mailing list · advisory pihak ketiga
• https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8
• https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d
• https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe