If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Fix
Patch, vendor advisory and mitigation references on NVD 10
- https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c Patch
- https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb Patch
- https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94 Patch
- https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840 Patch
- https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd Patch
- https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19 Patch
- https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4 Patch
- https://github.com/python/cpython/issues/146581 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://github.com/python/cpython/pull/146591 Issue Tracking, Patch
- https://mail.python.org/archives/list/[email protected]/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/ Mailing List, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.0 · pythonNVD modified 2026-10-26 21:10
Affected (CPE criteria) 9
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*cpe:2.3:a:python:python:3.15.0:alpha8:*:*:*:*:*:*
References 14
- https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8
- https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8c Patch
- https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4d
- https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cb Patch
- https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94 Patch
- https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefe
- https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840 Patch
- https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fd Patch
- https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19 Patch
- https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4 Patch
- https://github.com/python/cpython/issues/146581 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://github.com/python/cpython/pull/146591 Issue Tracking, Patch
- https://mail.python.org/archives/list/[email protected]/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/ Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/28/9 Mailing List, Third Party Advisory