CVE-2026-3087 in CPython
要約
〜によって MITRE • 2026年04月28日
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.