diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst index 3fdbd97b8beb93..9394746f6af2a9 100644 --- a/Doc/library/zipfile.rst +++ b/Doc/library/zipfile.rst @@ -528,6 +528,14 @@ Path Objects e.g. 'dir/file.txt', 'dir/', or ''. Defaults to the empty string, indicating the root. + .. note:: + The :class:`Path` class does not sanitize filenames within the ZIP archive. Unlike + the :meth:`ZipFile.extract` and :meth:`ZipFile.extractall` methods, it is the + caller's responsibility to validate or sanitize filenames to prevent path traversal + vulnerabilities (e.g., filenames containing ".." or absolute paths). When handling + untrusted archives, consider resolving filenames using :func:`os.path.abspath` + and checking against the target directory with :func:`os.path.commonpath`. + Path objects expose the following features of :mod:`pathlib.Path` objects: