shutil.unpack_archive() on Windows writes outside extract_dir for ZIP entries with drive-prefixed names · Issue #146581 · python/cpython · GitHub

github.com

Tin mới

GitHub CopilotWrite better code with AI

GitHub Copilot appDirect agents from issue to merge

ActionsAutomate any workflow

CodespacesInstant dev environments

IssuesPlan and track work

Code ReviewManage code changes

Code QualityEnforce quality at merge

GitHub Advanced SecurityFind and fix vulnerabilities

Code securitySecure your code as you build

Secret protectionStop leaks before they start

View all use cases

Financial services

View all industries

Software Development

GitHub SponsorsFund open source developers

Copilot for BusinessEnterprise-grade AI features

Premium SupportEnterprise-grade 24/7 support

Pull requests 2.6k

Security and quality 0

3.10only security fixes

3.11only security fixes

3.12only security fixes

3.13bugs and security fixes

3.14bugs and security fixes

3.15pre-release feature fixes, bugs and security fixes

stdlibStandard Library Python modules in the Lib/ directory

type-securityA security issue

shutil_unpack_archive_zip_windows_drive_path_min.zip

I found a Windows-specific issue in shutil.unpack_archive() when extracting ZIP files.

gh-146581: Use ZipFile.extractall() in shutil for secure ZIP extraction #146588

gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows #146591

[3.14] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) #149064

[3.13] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) #149065

[3.12] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) #149066

[3.11] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) #149071

gh-146581: Update docs for dangerous filenames in ZIP files #149994

[3.15] gh-146581: Update docs for dangerous filenames in ZIP files (GH-149994) #150064

[3.14] gh-146581: Update docs for dangerous filenames in ZIP files (GH-149994) #150065

[3.13] gh-146581: Update docs for dangerous filenames in ZIP files (GH-149994) #150066

[3.10] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) (GH-149071) #155440