CVE-2026-25645: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
Impact The requests.utils.extractzippedpaths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.
Affected usages Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extractzippedpaths() directly are impacted.
Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.
If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.
Other sources
Requests has Insecure Temp File Reuse in its extractzippedpaths() utility function
— Microsoft
Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call extractzippedpaths() directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set TMPDIR in their environment to a directory with restricted write access.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/requeststo a version that resolves this vulnerability.Fixed in 2.33.0 - Upgrade
Upgrade
requeststo a version that resolves this vulnerability.Fixed in 2.33.0 - Configuration
If unable to upgrade, set TMPDIR in the environment to a directory with restricted write access to prevent pre-creation of malicious files in the temp directory.
Environment TMPDIR = a directory with restricted write access
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25645?
CVE-2026-25645 is classified as a high severity vulnerability due to the potential for unauthorized file overwriting.
How do I fix CVE-2026-25645?
To fix CVE-2026-25645, update the requests library to version 2.33.0 or later.
What is the impact of CVE-2026-25645?
The impact of CVE-2026-25645 includes the risk of overwriting existing files in the system temporary directory.
Which versions of requests are affected by CVE-2026-25645?
CVE-2026-25645 affects all versions of requests up to but not including version 2.33.0.
Where can I find more information about CVE-2026-25645?
More information about CVE-2026-25645 can be found in the security advisories on the GitHub repository for requests.