CVE-2026-3087 in CPython
الملخص
بحسب MITRE • 28/04/2026
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.