gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows by serhiy-storchaka · Pull Request #146591 · python/cpython · GitHub

github.com

Tin mới

serhiy-storchaka:shutil-unpack_archive-extractall

miss-islington-app

GitHub CopilotWrite better code with AI

GitHub Copilot appDirect agents from issue to merge

ActionsAutomate any workflow

CodespacesInstant dev environments

IssuesPlan and track work

Code ReviewManage code changes

Code QualityEnforce quality at merge

GitHub Advanced SecurityFind and fix vulnerabilities

Code securitySecure your code as you build

Secret protectionStop leaks before they start

View all use cases

Financial services

View all industries

Software Development

GitHub SponsorsFund open source developers

Copilot for BusinessEnterprise-grade AI features

Premium SupportEnterprise-grade 24/7 support

Pull requests 2.6k

Security and quality 0

shutil.unpack_archive() on Windows writes outside extract_dir for ZIP entries with drive-prefixed names #146581

Fix vulnerability in shutil.unpack_archive() in ZIP files

Preserve the current behavior whether it is possible.

Preserve the current behavior whether it is possible.

Merge remote-tracking branch 'refs/remotes/origin/shutil-unpack_archi…

Merge branch 'main' into shutil-unpack_archive-extractall

needs backport to 3.10

needs backport to 3.11

needs backport to 3.12

needs backport to 3.13

needs backport to 3.14

awaiting core review

gh-146581: Use ZipFile.extractall() in shutil for secure ZIP extraction #146588

View reviewed changes

Learn more about hiding disruptive comments

The reason will be displayed to describe this comment to others. Learn more.

bedevere-app Bot commented Apr 27, 2026

GH-149064 is a backport of this pull request to the 3.14 branch.

: Fix vulnerability in shutil.unpack_archive() for ZI…

: Fix vulnerability in shutil.unpack_archive() for ZI…

gh-111791: delegating extraction to zipfile module's extractall() method #111824

shutil.unpack_archive skips false negatives containing '..' #111791

Remove private stdlib helpers orphaned by past removals #150882

: Remove unused shutil._ensure_directory

gh-150885: Remove unused shutil._ensure_directory #150883

Remove unused private function shutil._ensure_directory #150885

: Remove unused shutil._ensure_directory

: Remove unused shutil._ensure_directory (

: Remove unused shutil._ensure_directory (

: Fix vulnerability in shutil.unpack_archive() for ZI…

: Fix vulnerability in shutil.unpack_archive() for ZI…