If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

An update of the python3 package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive     (`C:\\...`) then the archive will be extracted outside the target directory which is different than other     operating systems. Only Windows is affected by this vulnerability. (CVE-2026-3087)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
333933	Photon OS 5.0: Python3 PHSA-2026-5.0-92-0862	Nessus	PhotonOS Local Security Checks	Local	medium
318606	Photon OS 5.0: Python3 PHSA-2026-5.0-0862	Nessus	PhotonOS Local Security Checks	Local	critical
310996	Linux Distros Unpatched Vulnerability : CVE-2026-3087	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-3087

medium

Tenable Plugins

medium

critical

medium