UpHeron
All vulnerabilities

Servers and applications

CVE-2026-3087

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

Severity
Medium 6.0
Published
27 Apr 2026
Last changed
13 Aug 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • Version 3.15.0-alpha8
  • Version 3.15.0-alpha7
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha5
All 9 release lines
  • Every version up to 3.14.4
  • Version 3.15.0-alpha1
  • Version 3.15.0-alpha2
  • Version 3.15.0-alpha3
  • Version 3.15.0-alpha4
  • Version 3.15.0-alpha5
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha7
  • Version 3.15.0-alpha8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-3087
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-3087