Python shutil CVE-2026-3087

Q: What is the CVSS score of CVE-2026-3087?

CVE-2026-3087 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25922 MEDIUM

Path Traversal (CWE-22)

2026-04-27 cna@python.org

Python Path Traversal Microsoft

6.0

CVSS 4.0 · Vendor: python

Severity by source

Vendor (python) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

No authentication inherent to the library; Windows-only prerequisite captured by context, not AC; high integrity from arbitrary write; no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (python).

CVSS VectorVendor: python

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:59 vuln.today

Analysis Generated

Jul 24, 2026 - 04:59 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 21:22 euvd

EUVD-2026-25922

CVE Published

Apr 27, 2026 - 21:16 nvd

MEDIUM 6.0

DescriptionCVE.org

If shutil.unpack_archive() is given a ZIP archive with an absolute Windows path containing a drive (C:\\...) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

AnalysisAI

Path traversal in CPython's shutil.unpack_archive() on Windows allows arbitrary file writes outside the intended extraction directory when processing ZIP archives containing Windows drive-letter absolute paths (e.g., C:\..., D:\...). The existing sanitization in _unpack_zipfile() rejected only Unix-style absolute paths (/) and directory traversal sequences (..), leaving Windows drive specifiers completely unchecked. No public exploit has been identified at time of analysis; EPSS of 0.05% (14th percentile) and SSVC exploitation status of 'none' indicate no observed exploitation, though the high integrity impact warrants patching in environments that process untrusted ZIP archives on Windows.

Technical ContextAI

The vulnerable code in Lib/shutil.py iterated over ZIP entries and used os.path.join(extract_dir, *name.split('/')) to construct target paths. On Windows, Python's os.path.join() silently discards preceding components when a path element contains a drive root (e.g., C:\), so a ZIP entry named C:/Windows/evil.dll would resolve entirely to C:\Windows\evil.dll, ignoring extract_dir. The original filter checked only for names starting with / or containing .., missing Windows-specific absolute forms such as C:/, D:\, E:relative, //server/share, and \\server2\share. The CWE-22 root cause is path traversal via absolute path injection rather than relative component escape. CPE strings confirm all CPython versions are affected (cpe:2.3:a:python:python:*:*:*:*:*:*:*:*) exclusively on Windows; macOS and Linux handle these path components literally and are not vulnerable. The fix (PR #146591) replaces manual extraction with zipfile.ZipFile.extractall() under a new _ignore_invalid_names flag and adds os.path.splitroot() logic in zipfile._extract_member() to detect and discard entries with drive letters, root separators, or post-sanitization name changes.

RemediationAI

Upgrade to a patched CPython release once available; fixes have been committed to multiple CPython maintenance branches via commits ab5ef98, b01e594, fc829e8, 65b2554, 8e13025, 8ee6aff, and ba0aca3 (consolidated in PR #146591 at https://github.com/python/cpython/pull/146591), but a specific tagged release version containing these patches has not been confirmed in the available data - monitor the Python security announcements list at https://mail.python.org/archives/list/security-announce@python.org/ for an official release notice. As an interim compensating control, applications that process user-supplied ZIP files on Windows should pre-filter all member filenames before calling shutil.unpack_archive(), rejecting any entry whose name matches a Windows drive-letter pattern (e.g., re.match(r'^[A-Za-z]:', name)) or any absolute-rooted form; this adds a validation step that the callee currently omits. Alternatively, replace shutil.unpack_archive() with a custom extraction loop that calls os.path.splitroot() and discards entries where the drive or root component is non-empty. Restricting upload functionality to authenticated, trusted users reduces exposure but does not eliminate the path traversal defect. Running the Python process under a low-privilege account without write access to sensitive system directories (e.g., C:\Windows\System32) is a defense-in-depth measure that limits the impact of successful exploitation.