{"id":"CVE-2026-25645","aliases":["GHSA-gc5v-m9x4-r6x2","PYSEC-2026-2275"],"title":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","vendor":"requests","product":"requests","ecosystem":"pip","affected":["requests < 2.33.0"],"patched":["requests 2.33.0"],"published":"2026-03-25","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:39.207922076Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2","references":[{"url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"url":"https://github.com/psf/requests"},{"url":"https://github.com/psf/requests/releases/tag/v2.33.0"}],"tags":["osv","pip","exploit-available"],"epss":0.00182,"epssPercentile":0.08046,"exploits":{"github":1,"githubRepos":["https://github.com/Jaycelation/CVE-2026-25645"],"checkedAt":"2026-09-21T15:28:33.361Z"},"exploitAvailable":true,"ingestedAt":"2026-07-13T18:57:58.243Z","slug":"CVE-2026-25645","body":"## Overview\n\n### Impact\nThe `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.\n\n### Affected usages\n**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.\n\n### Remediation\nUpgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.\n\nIf developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.\n\n## Affected packages\n\n- `requests < 2.33.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `requests 2.33.0`","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":201481,"id":"CVE-2026-25645","ts":1789399492779,"field":"exploit_available","old":"false","new":"true"},{"seq":200215,"id":"CVE-2026-25645","ts":1789397052361,"field":"exploit_available","old":"true","new":"false"},{"seq":198139,"id":"CVE-2026-25645","ts":1789391726395,"field":"exploit_available","old":"false","new":"true"},{"seq":195932,"id":"CVE-2026-25645","ts":1789383380191,"field":"exploit_available","old":"true","new":"false"},{"seq":194861,"id":"CVE-2026-25645","ts":1789380297174,"field":"exploit_available","old":"false","new":"true"},{"seq":193648,"id":"CVE-2026-25645","ts":1789378245568,"field":"exploit_available","old":"true","new":"false"},{"seq":192435,"id":"CVE-2026-25645","ts":1789376217677,"field":"exploit_available","old":"false","new":"true"},{"seq":191222,"id":"CVE-2026-25645","ts":1789373106230,"field":"exploit_available","old":"true","new":"false"},{"seq":190007,"id":"CVE-2026-25645","ts":1789369118247,"field":"exploit_available","old":"false","new":"true"},{"seq":188794,"id":"CVE-2026-25645","ts":1789368032839,"field":"exploit_available","old":"true","new":"false"},{"seq":187577,"id":"CVE-2026-25645","ts":1789364986804,"field":"exploit_available","old":"false","new":"true"},{"seq":186364,"id":"CVE-2026-25645","ts":1789362973549,"field":"exploit_available","old":"true","new":"false"},{"seq":185150,"id":"CVE-2026-25645","ts":1789360957992,"field":"exploit_available","old":"false","new":"true"},{"seq":183937,"id":"CVE-2026-25645","ts":1789357913736,"field":"exploit_available","old":"true","new":"false"},{"seq":182189,"id":"CVE-2026-25645","ts":1789354081173,"field":"exploit_available","old":"false","new":"true"},{"seq":180982,"id":"CVE-2026-25645","ts":1789352931455,"field":"exploit_available","old":"true","new":"false"},{"seq":179775,"id":"CVE-2026-25645","ts":1789349983438,"field":"exploit_available","old":"false","new":"true"},{"seq":178568,"id":"CVE-2026-25645","ts":1789347776922,"field":"exploit_available","old":"true","new":"false"},{"seq":177361,"id":"CVE-2026-25645","ts":1789346169141,"field":"exploit_available","old":"false","new":"true"},{"seq":176154,"id":"CVE-2026-25645","ts":1789342719851,"field":"exploit_available","old":"true","new":"false"},{"seq":175938,"id":"CVE-2026-25645","ts":1789342331791,"field":"exploit_available","old":"false","new":"true"},{"seq":175478,"id":"CVE-2026-25645","ts":1789338372391,"field":"exploit_available","old":"true","new":"false"},{"seq":174273,"id":"CVE-2026-25645","ts":1789334587781,"field":"exploit_available","old":"false","new":"true"},{"seq":173068,"id":"CVE-2026-25645","ts":1789333195601,"field":"exploit_available","old":"true","new":"false"},{"seq":171882,"id":"CVE-2026-25645","ts":1789330875117,"field":"exploit_available","old":"false","new":"true"},{"seq":170696,"id":"CVE-2026-25645","ts":1789328376238,"field":"exploit_available","old":"true","new":"false"},{"seq":169491,"id":"CVE-2026-25645","ts":1789326897778,"field":"exploit_available","old":"false","new":"true"},{"seq":168286,"id":"CVE-2026-25645","ts":1789323414384,"field":"exploit_available","old":"true","new":"false"},{"seq":167081,"id":"CVE-2026-25645","ts":1789319359067,"field":"exploit_available","old":"false","new":"true"},{"seq":165876,"id":"CVE-2026-25645","ts":1789318255868,"field":"exploit_available","old":"true","new":"false"},{"seq":164671,"id":"CVE-2026-25645","ts":1789315528967,"field":"exploit_available","old":"false","new":"true"},{"seq":163466,"id":"CVE-2026-25645","ts":1789313244305,"field":"exploit_available","old":"true","new":"false"},{"seq":162261,"id":"CVE-2026-25645","ts":1789311709214,"field":"exploit_available","old":"false","new":"true"},{"seq":161056,"id":"CVE-2026-25645","ts":1789308247690,"field":"exploit_available","old":"true","new":"false"},{"seq":160561,"id":"CVE-2026-25645","ts":1789304187915,"field":"exploit_available","old":"false","new":"true"},{"seq":158399,"id":"CVE-2026-25645","ts":1789299258997,"field":"exploit_available","old":"true","new":"false"},{"seq":157363,"id":"CVE-2026-25645","ts":1789296455949,"field":"exploit_available","old":"false","new":"true"},{"seq":156158,"id":"CVE-2026-25645","ts":1789294362295,"field":"exploit_available","old":"true","new":"false"},{"seq":154953,"id":"CVE-2026-25645","ts":1789292629794,"field":"exploit_available","old":"false","new":"true"},{"seq":153748,"id":"CVE-2026-25645","ts":1789289334344,"field":"exploit_available","old":"true","new":"false"},{"seq":152960,"id":"CVE-2026-25645","ts":1789285237200,"field":"exploit_available","old":"false","new":"true"},{"seq":152204,"id":"CVE-2026-25645","ts":1789280951801,"field":"exploit_available","old":"true","new":"false"},{"seq":151165,"id":"CVE-2026-25645","ts":1789277447804,"field":"exploit_available","old":"false","new":"true"},{"seq":147894,"id":"CVE-2026-25645","ts":1789270867918,"field":"exploit_available","old":"true","new":"false"},{"seq":145934,"id":"CVE-2026-25645","ts":1789269172155,"field":"exploit_available","old":"false","new":"true"},{"seq":144837,"id":"CVE-2026-25645","ts":1789266102768,"field":"exploit_available","old":"true","new":"false"},{"seq":143741,"id":"CVE-2026-25645","ts":1789262438289,"field":"exploit_available","old":"false","new":"true"},{"seq":142577,"id":"CVE-2026-25645","ts":1789261175664,"field":"exploit_available","old":"true","new":"false"},{"seq":141413,"id":"CVE-2026-25645","ts":1789258608424,"field":"exploit_available","old":"false","new":"true"},{"seq":140215,"id":"CVE-2026-25645","ts":1789256389372,"field":"exploit_available","old":"true","new":"false"}]}