logo

Database

Lack of data validation - Path Traversal In python

Description

shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs If shutil.unpack_archive() is given a ZIP archive with an absolute Windows path containing a drive (C:\\...) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version

Aliases

1. CVE-2026-30872. NVD-2026-30873. OSV-2026-30874. GCVE-2026-30875. https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3087.json6. mail.python.org

References

1. http://www.openwall.com/lists/oss-security/2026/04/28/92. https://github.com/python/cpython/issues/1465813. https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e84. https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c5. https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d6. https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb7. https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c948. https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe9. https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef284010. https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd11. https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c1912. https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f413. https://github.com/python/cpython/pull/146591

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.

FLAT-POEP9 – Vulnerability | Fluid Attacks Database