shutil.unpack_archive() extracts the contents of a ZIP file into a target directory, but when the archive contains an absolute Windows path that starts with a drive letter, the function ignores the target directory and writes files wherever the path points. This behavior enables an attacker to overwrite or create files outside the intended extraction area, effectively a directory traversal vulnerability (CWE‑22).

All CPython releases that include the standard library function shutil.unpack_archive() are vulnerable on Windows. The flaw is specific to the Windows platform; other operating systems correctly enforce the target directory. Exact versions are not listed, so any CPython installation on Windows that calls unpack_archive to extract ZIP archives should be treated as affected until a patch is applied.

The CVSS score of 6 indicates medium severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires supply of a malicious ZIP file to code that calls unpack_archive, making the attack vector local or user‑controlled. An attacker could place files on the system, potentially overwriting existing files or writing malicious payloads to unintended locations.