The vulnerability CVE-2026-3087 in Python's CPython involves the shutil.unpack_archive() function improperly handling ZIP archives that contain absolute Windows paths with drive letters. This allows extraction of files outside the specified target directory on Windows systems, constituting a directory traversal (CWE-22) flaw. This issue is specific to Windows and does not affect other operating systems. The vulnerability was published on 2026-04-27 with a CVSS 4.0 score of 6. The Python Software Foundation has not yet provided an official fix or remediation level for this issue.

Successful exploitation allows an attacker to cause files within a ZIP archive to be extracted outside the intended directory on Windows systems, potentially overwriting arbitrary files. This could lead to unauthorized file modification or code execution depending on the context in which shutil.unpack_archive() is used. The impact is limited to Windows platforms due to the handling of absolute Windows paths with drive letters.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is released, users should avoid unpacking untrusted ZIP archives with shutil.unpack_archive() on Windows or implement additional validation to prevent extraction outside the target directory.