shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• python pythonup to 3.14.4 inclusive
• python python3.15.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (PSF). Independent of NVD's CPE analysis and usually ahead of it.

• Python Software Foundation CPython

  • before 3.10.21affected · python
  • 3.11.0 and later · before 3.11.16affected · python
  • 3.12.0 and later · before 3.12.14affected · python
  • 3.13.0 and later · before 3.13.14affected · python
  • 3.14.0a1 and later · before 3.14.5rc1affected · python
  • 3.15.0a1 and later · before 3.15.0b1affected · python

Other highest-scoring records for the same primary product.

• CVE-2016-5636Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 all
  47Plan
• CVE-2007-4559Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remot
  47Plan
• CVE-2021-3177Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Pyth
  46Plan
• CVE-2014-4650The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which al
  46Plan
• CVE-2018-1000802Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('C
  45Plan
• CVE-2020-27619In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
  42Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.