ИнструментыУязвимости БДУБлоклистыРасширениеУтилитыБлогAPIМониторинг
Главная → Уязвимости → CVE-2026-3087
7.5высокая

CVE-2026-3087

Описание

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

Затрагиваемое ПО
Python PythonMicrosoft Windows
CVSS
Балл7.5 — высокая
ВекторCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Источники
https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8chttps://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cbhttps://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fdhttps://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4https://github.com/python/cpython/issues/146581