CVE-2026-25645

mediumpriority · track · 32EPSS 0.002 · 8 %ileexploit · PoCDEEUFRRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.19% (8th) EPSS

CVSS 5.5 · medium

Is it mine?

39 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedpython311-requests-0:2.33.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython311-requests-0:2.33.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython311-requests-0:2.33.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython311-requests-0:2.33.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython313-requests-0:2.33.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython313-requests-0:2.33.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython313-requests-0:2.33.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython313-requests-0:2.33.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.15.5mediumAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.14.4mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.14.4mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:Nsecondary · security-advisories@github.comexploitability 0.8 · impact 3.6

v3.14.4mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:Nsecondary · OSV

v3.15.2mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:Psecondary · CVSS-BT (t0sche)

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Nsecondary · SUSE Product Security

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-377USCWE-377USCWE-377US

exploits (1)

Public proof-of-concept and weaponised exploit code.

Jaycelation/CVE-2026-25645Insecure Temp File Reuse in extract_zipped_paths()PoC · poc_in_github

affected products (39)

Products and version ranges known to be affected.

psf Requests≤ < 2.33.0enisa_euvdEU
Fedora Project Fedora≤ 43fstec_bduRU
Fedora Project Fedora≤ 44fstec_bduRU
Python Software Foundation requests≤ 2.33.0fstec_bduRU
Red Hat, Inc. Ansible Automation Platform≤ 2fstec_bduRU
Red Hat, Inc. Ansible Automation Platform≤ Ansible Core 2fstec_bduRU
Red Hat, Inc. External Secrets Operator for Red Hat OpenShiftall versionsfstec_bduRU
Red Hat, Inc. Lightspeed Coreall versionsfstec_bduRU
Red Hat, Inc. Logging subsystem for Red Hat OpenShiftall versionsfstec_bduRU
Red Hat, Inc. Migration Toolkit for Containersall versionsfstec_bduRU
Red Hat, Inc. Migration Toolkit for Virtualizationall versionsfstec_bduRU
Red Hat, Inc. OpenShift Container Platform≤ 4fstec_bduRU
Red Hat, Inc. Openshift Service Mesh≤ 3fstec_bduRU
Red Hat, Inc. Pen Drive Powered by Red Hat Lightspeedall versionsfstec_bduRU
Red Hat, Inc. Red Hat AI Inference Serverall versionsfstec_bduRU
Red Hat, Inc. Red Hat Developer Huball versionsfstec_bduRU
Red Hat, Inc. Red Hat Discovery≤ 2fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 7fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 9fstec_bduRU

showing 20 of 39

advisories (4)

Vendor and ecosystem advisories describing this.

openSUSE-SU-2026:10455-1python311-requests-2.33.0-1.1 on GA media2026-03-28csaf · suse_csafDE
python311-requests-2.33.0-1.1 on GA media
GHSA-gc5v-m9x4-r6x2Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function2026-03-25ghsa · osvUS
### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. ### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted. ### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
PYSEC-2026-22752026-03-25vendor · osvUS
Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv suse_csaf certfr NVD CVE.org MITRE

published 2026-03-25modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan