Description
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Remediation
References
Related Vulnerabilities
Oracle Application Server Other Vulnerability (CVE-2002-0566)
ReviveAdserver Session Fixation Vulnerability (CVE-2017-5831)
WordPress Plugin Nextend Twitter Connect Cross-Site Scripting (1.5.1)
MySQL Other Vulnerability (CVE-2005-2573)
OpenSSL Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2023-5678)