[3.11] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) by serhiy-storchaka · Pull Request #149071 · python/cpython

serhiy-storchaka

Open

serhiy-storchaka

wants to merge 1 commit into

python:3.11from

serhiy-storchaka:backport-fc829e8-3.11

Open

[3.11] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591)#149071
serhiy-storchaka
wants to merge 1 commit into
python:3.11from
serhiy-storchaka:backport-fc829e8-3.11

Conversation

serhiy-storchaka commented
Apr 27, 2026
•

edited by bedevere-app Bot

Loading

Copy link

Copy Markdown

Member

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.

(cherry picked from commit fc829e8)

Issue: shutil.unpack_archive() on Windows writes outside extract_dir for ZIP entries with drive-prefixed names #146581

pythongh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP…

cca6d2d

… files on Windows (pythonGH-146591)

Use ZipFile.extractall() to sanitize file names and extract files.

Files with invalid names (e.g. absolute paths) are now skipped.

Files containing ".." in the name are no longer skipped.

(cherry picked from commit fc829e8)

serhiy-storchaka added the needs backport to 3.10