psf requests up to 2.32.x requests.utils.extract_zipped_paths temp file

Summaryinfo

A vulnerability classified as problematic has been found in psf requests up to 2.32.x. Affected is the function requests.utils.extract_zipped_paths. This manipulation causes temp file. This vulnerability is registered as CVE-2026-25645. The attack needs to be launched locally. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in psf requests up to 2.32.x. It has been declared as problematic. Affected by this vulnerability is the function requests.utils.extract_zipped_paths. The manipulation with an unknown input leads to a temp file vulnerability. The CWE definition for the vulnerability is CWE-377. Creating and using insecure temporary files can leave application and system data vulnerable to attack. As an impact it is known to affect integrity. The summary by CVE is:

Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-25645 since 02/04/2026. The exploitation appears to be difficult. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 303843 (Linux Distros Unpatched Vulnerability : CVE-2026-25645), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.33.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 66d21cb07bd6255b1280291c4fafb71803cdb3b7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (303843). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• psf

Name

• requests

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32

License

• open-source

Website

• Product: https://github.com/psf/requests/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion