CVE-2026-3087
If is given a ZIP archive with an absolute Windows path containing a drive ( ) then the archive will be extracted outside the target directory which is different than…
Published Apr 27, 2026 · updated Aug 13, 2026 · python python
If is given a ZIP archive with an absolute Windows path containing a drive ( ) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 27, 2026 · NIST NVD
Detected
If is given a ZIP archive with an absolute Windows path containing a drive ( ) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Aug 13, 2026 · NIST NVD
Updated
If is given a ZIP archive with an absolute Windows path containing a drive ( ) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Affected
- cpe python/pythonversion unspecified
- cpe python/python3.15.0
Sources
- CVE.orgVulnerability recordCVE-2026-3087
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-3087
If is given a ZIP archive with an absolute Windows path containing a drive ( ) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
nvd.nist.gov