CVE-2026-25645Medium· 4.4▾ TwilightPoC availableRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 24.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.2%
Last analysed / modified upstream
1 GitHub repo
The requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.
Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extract_zipped_paths() directly are impacted.
Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.
If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.
requests < 2.33.0Upgrade to a patched release:
requests 2.33.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-32681Medium· 6.1Unintended leak of Proxy-Authorization header in requests
CVE-2024-35195Medium· 5.6Requests `Session` object does not verify requests after making first request with verify=False
CVE-2024-47081Medium· 5.3Requests vulnerable to .netrc credentials leak via malicious URLs