The vulnerability in CPython's shutil.unpack_archive() function allows ZIP archives with absolute Windows paths containing drive letters to be extracted outside the specified target directory on Windows systems. This directory traversal issue (CWE-22) can lead to files being placed in unintended locations, potentially overwriting important files or bypassing security controls. Only Windows platforms are affected due to the handling of absolute Windows paths. The affected versions are 3.14.0a1, 3.14.0, 3.15.0a1, and 3.15.0. There is no vendor advisory indicating an official fix or patch at this time.

On Windows systems, an attacker who can supply a crafted ZIP archive to shutil.unpack_archive() may cause files to be extracted outside the intended directory. This could lead to overwriting or placing files in arbitrary locations, potentially impacting system integrity or security. The vulnerability does not affect other operating systems. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid unpacking untrusted ZIP archives with shutil.unpack_archive() on Windows or implement additional validation to prevent extraction of absolute paths with drive letters.