CVE-2026-25645 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
A local attacker can exploit predictable temp file names in Requests' zip extraction to replace legitimate files with malicious ones, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-25645?
CVE-2026-25645 is a medium-severity path traversal vulnerability in psf requests, published on 25 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.
Weakness: CWE-377
Which versions are affected by CVE-2026-25645?
3 open source packages ship an affected version, including requests. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
requests PyPI | All versions | 2.33.0 |
requests PyPI | All versions | 2.33.0 |
requests PyPI | All versions | 2.33.0 |
Linux distribution packages (9)
python-requests SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 2.24.0-8.26.1 |
python-requests SUSE:Linux Enterprise Server 16.0 | All versions | 2.32.4-160000.3.1 |
python-requests SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.24.0-8.26.1 |
python-requests SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.32.4-160000.3.1 |
python-requests SUSE:Linux Micro 6.0 | All versions | 2.32.3-3.1 |
python-requests SUSE:Linux Micro 6.1 | All versions | 2.32.4-slfo.1.1_2.1 |
python-requests SUSE:Linux Micro 6.2 | All versions | 2.32.4-160000.3.1 |
python-requests openSUSE:Leap 16.0 | All versions | 2.32.4-160000.3.1 |
python-requests openSUSE:Tumbleweed | All versions | 2.33.0-1.1 |
Products include Python Requests.
How do I fix CVE-2026-25645?
Upgrade requests to 2.33.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25645 being exploited?
There is no known exploitation of CVE-2026-25645 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-25645, AZL-80996, BELL-CVE-2026-25645, CLEANSTART-2026-AZ59995, CLEANSTART-2026-FE88742, CLSA-2026-1780879897 and 36 more.