The vulnerability CVE-2026-3087 in CPython's shutil.unpack_archive() function allows a ZIP archive with absolute Windows paths containing drive letters to be extracted outside the specified target directory on Windows systems. This is a path traversal issue (CWE-22) that can lead to files being placed in unintended locations, potentially overwriting or creating files outside the extraction directory. This behavior is unique to Windows and does not affect other operating systems. The affected versions explicitly include CPython 3.14.0, 3.15.0, and their alpha releases. No official patch or remediation level has been published by the Python Software Foundation at this time.

An attacker who can supply a crafted ZIP archive to shutil.unpack_archive() on Windows can cause files to be extracted outside the intended directory. This could lead to overwriting critical files or placing malicious files in sensitive locations. The impact depends on the context in which the function is used and the privileges of the executing process. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.0.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is released, users should avoid unpacking untrusted ZIP archives containing absolute Windows paths with drive letters using shutil.unpack_archive() on Windows or implement additional validation to sanitize archive contents before extraction.