CVE-2026-3087

HighCVSS 7.5/10Last modified Aug 13, 2026

Description

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 27, 2026
Last modified: Aug 13, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-308706.5PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edit CVE-2026-308719.8OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stac CVE-2026-308729.8OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stac CVE-2026-308734.9OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token func CVE-2026-308747.8OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call fu CVE-2026-308758.8Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allo CVE-2026-308765.3Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username CVE-2026-308777.2baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functional CVE-2026-308785.3baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mai CVE-2026-308796.1baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a cross-site scripting vulnerability in blog posts. This i CVE-2026-30886.5Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests.CVE-2026-308809.8baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. Th