◐ Shell
reader mode source ↗
Skip to content

gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows#146591

Merged
serhiy-storchaka merged 6 commits into
python:mainfrom
serhiy-storchaka:shutil-unpack_archive-extractall
Apr 27, 2026
Merged

gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows#146591
serhiy-storchaka merged 6 commits into
python:mainfrom
serhiy-storchaka:shutil-unpack_archive-extractall

Conversation

@serhiy-storchaka

@serhiy-storchaka serhiy-storchaka commented Mar 29, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.

@serhiy-storchaka
Fix vulnerability in shutil.unpack_archive() in ZIP files …
7c5ad11 
Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now extracted with
different names instead of been skipped or written out of the destination
directory.

Files containing ".." in the name are no longer skipped.
@serhiy-storchaka
Preserve the current behavior whether it is possible.
8d0ade5
@serhiy-storchaka
Preserve the current behavior whether it is possible.
7940084
@serhiy-storchaka
Merge remote-tracking branch 'refs/remotes/origin/shutil-unpack_archi… …
faddc67 
…ve-extractall' into shutil-unpack_archive-extractall
@serhiy-storchaka
Merge branch 'main' into shutil-unpack_archive-extractall
76797cc
@serhiy-storchaka
Add a NEWS entry.
12cf735
@serhiy-storchaka serhiy-storchaka added type-security A security issue needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Mar 29, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Mar 29, 2026
Open
@StanFromIreland StanFromIreland mentioned this pull request Mar 29, 2026
Closed
@Shrey-N

Shrey-N commented Mar 29, 2026

Copy link
Copy Markdown
Contributor

Wasn't os.path.splitroot() introduced in 3.12? if it is backported wouldn't it crash with AttributeError?

@Shrey-N

Shrey-N commented Mar 29, 2026

Copy link
Copy Markdown
Contributor

Also, the new os.path.pardir check misses backslash based traversals on Linux/macOS.
The old substring check if '..' in name caught these, but the new component based check treats that whole string as a single (but malicious) filename.

@serhiy-storchaka

serhiy-storchaka commented Mar 29, 2026

Copy link
Copy Markdown
Member Author

Wasn't os.path.splitroot() introduced in 3.12? if it is backported wouldn't it crash with AttributeError?

Backports will be fixed to use equivalent code.

Also, the new os.path.pardir check misses backslash based traversals on Linux/macOS.

Backslash is not a separator on Posix. It is a legal character which has no special meaning.

@Shrey-N

Shrey-N commented Mar 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

I believe it’s actually a regression. Currently, shutil uses a substring check which correctly catches and skips these backslash traversals on Linux.

In this PR it switches to a component based check, which removes that existing protection.

So I believe this actually reduces the existing security strictness for non windows users

@serhiy-storchaka

serhiy-storchaka commented Mar 30, 2026

Copy link
Copy Markdown
Member Author

There is no backslash traversal on Linux.

Hide details View details @serhiy-storchaka serhiy-storchaka merged commit fc829e8 into python:main Apr 27, 2026
110 of 112 checks passed
@miss-islington-app

miss-islington-app Bot commented Apr 27, 2026

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

@serhiy-storchaka serhiy-storchaka deleted the shutil-unpack_archive-extractall branch April 27, 2026 18:43
11 hidden items Load more…
@bedevere-app

bedevere-app Bot commented Apr 27, 2026

Copy link
Copy Markdown

GH-149064 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Apr 27, 2026
@bedevere-app

bedevere-app Bot commented Apr 27, 2026

Copy link
Copy Markdown

GH-149065 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Apr 27, 2026
@miss-islington-app

miss-islington-app Bot commented Apr 27, 2026

Copy link
Copy Markdown

Sorry, @serhiy-storchaka, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker fc829e88753858c8ac669594bf0093f44948c0f4 3.11

@bedevere-app

bedevere-app Bot commented Apr 27, 2026

Copy link
Copy Markdown

GH-149066 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Apr 27, 2026
@miss-islington-app

miss-islington-app Bot commented Apr 27, 2026

Copy link
Copy Markdown

Sorry, @serhiy-storchaka, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker fc829e88753858c8ac669594bf0093f44948c0f4 3.10

@bedevere-app

bedevere-app Bot commented Apr 27, 2026

Copy link
Copy Markdown

GH-149071 is a backport of this pull request to the 3.11 branch.

serhiy-storchaka added a commit that referenced this pull request Apr 27, 2026
@miss-islington @serhiy-storchaka
[3.13] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZI… …
ab5ef98 
…P files on Windows (GH-146591) (GH-149065)

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.
(cherry picked from commit fc829e8)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
serhiy-storchaka added a commit that referenced this pull request Apr 27, 2026
@miss-islington @serhiy-storchaka
[3.14] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZI… …
b01e594 
…P files on Windows (GH-146591) (GH-149064)

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.
(cherry picked from commit fc829e8)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@serhiy-storchaka serhiy-storchaka removed the needs backport to 3.10 only security fixes label Apr 27, 2026
@serhiy-storchaka serhiy-storchaka removed their assignment Apr 27, 2026
This was referenced May 18, 2026
Closed
Closed
@gaborbernat gaborbernat mentioned this pull request Jun 3, 2026
Closed
gaborbernat added a commit to gaborbernat/cpython that referenced this pull request Jun 3, 2026
@gaborbernat
pythongh-150882: Remove unused shutil._ensure_directory …
448cb74 
Introduced in python#8295 alongside shutil.unpack_archive() as a helper that
created the parent directory of each extracted member.

Orphaned by pythongh-146581 (pythonGH-146591), the ZIP path-traversal fix, which
reworked _unpack_zipfile() to create directories inline and deleted the
last _ensure_directory(targetpath) call site in the same change.

Since then the private helper has had no caller: a word-boundary search
across Lib, Modules, Python, Objects and Include finds zero references
outside its own definition, and a GitHub code search finds no downstream
importers.
This was referenced Jun 3, 2026
Merged
Closed
gaborbernat added a commit to gaborbernat/cpython that referenced this pull request Jun 3, 2026
@gaborbernat
pythongh-150885: Remove unused shutil._ensure_directory …
5de9387 
Introduced in python#8295 alongside shutil.unpack_archive() as a helper that
created the parent directory of each extracted member.

Orphaned by pythongh-146581 (pythonGH-146591), the ZIP path-traversal fix, which
reworked _unpack_zipfile() to create directories inline and deleted the
last _ensure_directory(targetpath) call site in the same change.

Since then the private helper has had no caller: a word-boundary search
across Lib, Modules, Python, Objects and Include finds zero references
outside its own definition, and a GitHub code search finds no downstream
importers.
serhiy-storchaka pushed a commit that referenced this pull request Jun 7, 2026
@gaborbernat
gh-150885: Remove unused shutil._ensure_directory (GH-150883) …
e5ced1f 
No longer used after gh-146581 (GH-146591).
philthompson10 pushed a commit to philthompson10/cpython that referenced this pull request Jun 17, 2026
@gaborbernat @philthompson10
pythongh-150885: Remove unused shutil._ensure_directory (pythonGH-150883 …
77b5cd3 
)

No longer used after pythongh-146581 (pythonGH-146591).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zooba zooba zooba approved these changes

@giampaolo giampaolo Awaiting requested review from giampaolo giampaolo is a code owner

@sethmlarson sethmlarson Awaiting requested review from sethmlarson

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@serhiy-storchaka @Shrey-N @zooba