CVE-2026-25645

Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7	Patch
https://github.com/psf/requests/releases/tag/v2.33.0	Release Notes
https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:python:requests:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-25 17:16

Updated : 2026-06-17 10:25

NVD link : CVE-2026-25645

Mitre link : CVE-2026-25645

CVE.ORG link : CVE-2026-25645

JSON object : View

Products Affected

python

requests

CWE

CWE-377

Insecure Temporary File

{"id": "CVE-2026-25645", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25645", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T20:09:33.855806Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "psf", "product": "requests", "versions": [{"status": "affected", "version": "< 2.33.0"}]}]}], "published": "2026-03-25T17:16:52.970", "references": [{"url": "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/psf/requests/releases/tag/v2.33.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-377"}]}], "descriptions": [{"lang": "en", "value": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access."}, {"lang": "es", "value": "Requests es una biblioteca HTTP. Antes de la versi\u00f3n 2.33.0, la funci\u00f3n de utilidad 'requests.utils.extract_zipped_paths()' utiliza un nombre de archivo predecible al extraer archivos de archivos zip en el directorio temporal del sistema. Si el archivo de destino ya existe, se reutiliza sin validaci\u00f3n. Un atacante local con acceso de escritura al directorio temporal podr\u00eda pre-crear un archivo malicioso que se cargar\u00eda en lugar del leg\u00edtimo. El uso est\u00e1ndar de la biblioteca Requests no se ve afectado por esta vulnerabilidad. Solo las aplicaciones que llaman a 'extract_zipped_paths()' directamente se ven afectadas. A partir de la versi\u00f3n 2.33.0, la biblioteca extrae archivos a una ubicaci\u00f3n no determinista. Si los desarrolladores no pueden actualizar, pueden establecer 'TMPDIR' en su entorno a un directorio con acceso de escritura restringido."}], "lastModified": "2026-06-17T10:25:00.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python:requests:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B164516D-2E98-41D4-9CB7-40FD49A1B6D9", "versionEndExcluding": "2.33.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}