Security readout for executives and security teams
Plain-English summary
On Windows, a malicious ZIP processed by Python’s shutil.unpack_archive() can place files outside the intended extraction folder. This could let an attacker alter files accessible to the Python process. Other operating systems are not affected.
Executive priority
Prioritize prompt remediation for Windows services processing untrusted ZIPs. Systems without that data flow have substantially lower urgency but should still verify versions and patch status.
Technical view
CVE-2026-3087 is a CWE-22 path traversal issue. CPython does not correctly contain ZIP entries using absolute Windows drive paths during shutil.unpack_archive(). The supplied CVSS 4.0 score is 6.0, reflecting potentially high integrity impact without stated confidentiality or availability impact.
Likely exposure
Exposure is limited to Windows applications that use shutil.unpack_archive() for ZIP files and accept attacker-influenced archives. Risk depends on the Python process’s filesystem permissions. The supplied affected-version data is ambiguous, so exact vulnerable releases must be confirmed against PSF guidance.
Exploitation context
The supplied CVSS vector indicates network reachability, low attack complexity, low privileges, no user interaction, and a prerequisite condition. CISA KEV status is false, and the bundle provides no evidence of active exploitation.
Researcher notes
The core boundary failure is Windows-specific handling of drive-qualified absolute paths. Multiple CPython patch commits are referenced, but the bundle does not clearly map fixed versions or affected ranges. Validate branch applicability through the vendor advisory and pull request; do not infer exposure from version strings alone.
Mitigation direction
- Inventory Windows workloads using shutil.unpack_archive() to process ZIP files.
- Follow the PSF advisory and install the applicable fixed release or branch patch.
- Until patched, prevent affected workloads from processing attacker-controlled ZIP archives.
- Limit affected process write permissions to reduce potential integrity impact.
Validation and detection
- Confirm each relevant workload’s operating system, Python version, and distribution source.
- Identify shutil.unpack_archive() calls that can receive attacker-influenced ZIP files.
- Compare installed versions with the PSF advisory and applicable CPython branch patches.
- Safely verify that patched runtimes contain absolute Windows paths within the extraction directory.
- Review writable locations for unexplained file changes associated with archive-processing activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-3087 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N——PSFVulnerability scoring details
Base CVSS 4.0 score
6MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/python/cpython/pull/146591CVE reference, PSF · patch
- https://github.com/python/cpython/issues/146581CVE reference, PSF · issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/X6FXE5C6KDKOVNX3EC3DWD5RUPFWOZA4/CVE reference, PSF · vendor-advisory
- https://github.com/python/cpython/commit/ab5ef98af693bded74a738570e81ea70abef2840CVE reference, PSF · patch
- https://github.com/python/cpython/commit/b01e594fbe754a960212f908d047294e880b52fdCVE reference, PSF · patch
- https://github.com/python/cpython/commit/fc829e88753858c8ac669594bf0093f44948c0f4CVE reference, PSF · patch
- https://github.com/python/cpython/commit/65b255416ae217bf0e22085be3c1976cea18bd8cCVE reference, PSF · patch
- https://github.com/python/cpython/commit/8e13025747e1ca72e86d1f35637123f9c306f0cbCVE reference, PSF · patch
- https://github.com/python/cpython/commit/8ee6aff14054b37b53e47194a2fa313e98163c94CVE reference, PSF · patch
- https://github.com/python/cpython/commit/ba0aca3bffce431fe2fbd53ca4cd6a717a2e2c19CVE reference, PSF · patch
- https://github.com/python/cpython/commit/a6650a2cdf0c49fb8ce0c982903aa2aa274beefeCVE reference, PSF · patch
- https://github.com/python/cpython/commit/7ef7dd0a74f47facd1fadcbc77f8fb03beb5eb4dCVE reference, PSF · patch
- https://github.com/python/cpython/commit/1071290169f85c09cf767c1099564a9426cdc7e8CVE reference, PSF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.