René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"shutil.unpack_archive() on Windows writes outside extract_dir for ZIP entries with drive-prefixed names","articleBody":"# Bug report\n\n### Bug description:\n\n### Summary\n\nI found a Windows-specific issue in `shutil.unpack_archive()` when extracting ZIP files.\n\nIn `Lib/shutil.py`, the private helper `_unpack_zipfile()` skips names that start with `/` or contain `..`, but it does not reject or sanitize Windows drive-prefixed names such as `D:/path/file`.\n\nOn Windows, such names are joined into a drive-qualified path and can escape the intended extraction directory. As a result, a crafted ZIP archive can cause files to be written outside `extract_dir`.\n\n### Affected component\n\n- `Lib/shutil.py`\n- `_unpack_zipfile()`\n\n### Impact\n\nA crafted ZIP archive can cause an arbitrary file write outside `extract_dir` on Windows.\n\n### Trigger condition\n\n- Platform: Windows\n- Archive format: ZIP\n- A ZIP entry name contains a drive prefix such as `D:/...`\n- `extract_dir` is on a different drive\n\n### Tested environment\n\nI reproduced this on Windows with Python 3.12.8.\n\n### Minimal reproduction\n\nI attached a minimal repro script:\n\n- `repro_shutil_unpack_zip_windows_drive_path_min.py`\n\nThe repro creates a ZIP archive containing an entry like:\n\nD:/shutil_outside_min.txt\n\nand then calls:\n\nshutil.unpack_archive(str(zip_path), str(extract_dir))\nWith extract_dir on another drive, the file is written outside the intended extraction directory.\n\nRoot cause\nThe validation in _unpack_zipfile() appears incomplete for Windows path semantics. Checking only for leading / and .. is not sufficient, because drive-prefixed paths such as D:/... are still treated as rooted or drive-qualified paths by Windows path handling.\n\nFor comparison, zipfile's own extraction logic strips drive information before extraction, but shutil._unpack_zipfile() does not.\n\nExpected behavior\nZIP entries that are absolute, drive-prefixed, or otherwise resolve outside extract_dir on Windows should be rejected or normalized so that extraction always remains within extract_dir.\n\nActual behavior\nA crafted ZIP entry with a drive prefix can escape extract_dir and be written to another location.\n\nAdditional context\nI previously reported this privately to the Python Security Response Team on March 28, 2026, but I have not received a response yet, so I am opening this issue for tracking and triage.\n\nI also attached a short write-up:\n\nvuln_shutil_unpack_archive_zip_windows_drive_path.md\n\n[shutil_unpack_archive_zip_windows_drive_path_min.zip](https://github.com/user-attachments/files/26325208/shutil_unpack_archive_zip_windows_drive_path_min.zip)\n\n### CPython versions tested on:\n\nCPython main branch, 3.14\n\n### Operating systems tested on:\n\nWindows\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-146588\n* gh-146591\n* gh-149064\n* gh-149065\n* gh-149066\n* gh-149071\n* gh-149994\n* gh-150064\n* gh-150065\n* gh-150066\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/PuH4ck3rX","@type":"Person","name":"PuH4ck3rX"},"datePublished":"2026-03-28T17:55:41.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":7},"url":"https://github.com/146581/cpython/issues/146581"}