CVE-2026-25645

What it actually does

This is a local file-substitution race condition in Python Requests before 2.33.0, limited to applications that directly call requests.utils.extract_zipped_paths(). The vulnerable helper extracts files from ZIP archives into the system temporary directory using a predictable destination path and reuses an existing file without validating that it was created from the expected archive content. A local attacker who can write to the same temporary directory can pre-create the expected extracted file so that the application later loads attacker-controlled content instead of the legitimate ZIP member. Standard HTTP client usage of Requests is not affected.

Why it matters to the business

Business risk is generally limited because exploitation requires local access, write permission to the temporary directory, and an application-specific code path that directly uses the vulnerable utility. Where affected, the impact can be significant: applications may process or trust attacker-supplied local content, potentially causing data corruption, incorrect business logic decisions, poisoned configuration or resource files, or further compromise depending on how the extracted file is used. The low EPSS score and absence from CISA KEV indicate no current evidence of broad exploitation, but organizations with Python applications that use this helper should still remediate during normal patch cycles.

How an attack unfolds

An attacker first obtains low-privileged local access on a system running a Python application that directly invokes requests.utils.extract_zipped_paths(). The attacker determines or predicts the temporary-file path that Requests will use when extracting a file from a ZIP archive. Before the application performs extraction, the attacker creates a malicious file at that predictable path in a shared temporary directory such as /tmp. When the application later calls the vulnerable helper, Requests sees the file already present and reuses it rather than validating or replacing it with the ZIP member. The application then consumes the attacker-controlled file as if it came from the trusted archive. The practical result depends on the application: the attacker may influence file parsing, load malicious data, poison caches, or alter application behavior.

How to fix it

Upgrade Python Requests to version 2.33.0 or later, where extraction uses a non-deterministic location. Because standard Requests HTTP usage is not affected, prioritize systems and applications that directly call requests.utils.extract_zipped_paths(). If immediate upgrade is not possible, set TMPDIR to a directory that is not world-writable and is writable only by the application user, and ensure equivalent controls are applied for other platform-specific temporary-directory environment variables where relevant. Review application code for direct use of extract_zipped_paths() and replace it with safer extraction logic where possible, including unique temporary directories, secure file creation, ownership validation, and cleanup.

How to confirm the fix worked

Confirm installed Requests versions by inspecting package inventories, virtual environments, containers, build manifests, and lockfiles; affected deployments use requests versions earlier than 2.33.0. Confirm whether the application directly imports or calls requests.utils.extract_zipped_paths(); systems that do not call this utility are not affected by the described issue. Validate remediation by verifying Requests 2.33.0 or later is installed in the runtime actually used by the application. For mitigated systems, confirm TMPDIR points to a restricted directory owned by the application user and not writable by other local users. A practical exposure test is to run the affected application path in a non-production test environment while monitoring whether extracted ZIP members are written to predictable names in a shared temporary directory or whether pre-existing files are reused.

Typical attack path

1. Identify a Python application that uses Requests before version 2.33.0 and directly calls requests.utils.extract_zipped_paths().
2. Gain local low-privileged access or another ability to write into the same system temporary directory used by the application.
3. Predict the filename or path that the vulnerable helper will use for ZIP extraction.
4. Pre-create a malicious file at that path before the target application performs extraction.
5. Wait for or trigger the application code path that calls extract_zipped_paths().
6. Cause the application to read or process the attacker-controlled file instead of the intended ZIP archive member.
7. Leverage the application-specific handling of that file to alter behavior, corrupt data, or support further compromise.

How to detect it

There are no widely reported public exploitation patterns or known threat actors associated with this vulnerability, and it is not listed in CISA KEV. Detection should focus on exposure and local tampering evidence. Review application dependency inventories, SBOMs, virtual environments, and container images for Requests versions before 2.33.0. Search application source and deployed packages for direct use of requests.utils.extract_zipped_paths(). For possible exploitation, examine operating system audit logs, EDR file telemetry, and application logs for files created in shared temporary directories shortly before the affected application reads or extracts ZIP content. Look for temporary files owned by a different user than the application process, unexpected persistence of extracted files, permission anomalies, or repeated creation of the same predictable temporary path. On Linux, auditd or EDR events for open, creat, chmod, chown, and rename operations under /tmp, /var/tmp, or the configured TMPDIR can help reconstruct whether an unprivileged user pre-positioned files consumed by the application.

• requests.utils.extract_zipped_paths
• extract_zipped_paths(
• from requests.utils import extract_zipped_paths
• /tmp
• /var/tmp
• TMPDIR

What your security team should do

• Inventory Python applications and containers using the requests package and identify versions earlier than 2.33.0.
• Search source code and dependency usage for direct calls to requests.utils.extract_zipped_paths(); prioritize remediation only where that utility is used.
• Upgrade affected environments to Requests 2.33.0 or later and rebuild/redeploy application images so the fixed library is present at runtime.
• Where upgrade is delayed, set TMPDIR to an application-private directory with restrictive permissions and verify it is not shared or world-writable.
• Review local-user threat models for multi-user servers, shared build systems, CI runners, batch workers, and application hosts where untrusted users or jobs can write to shared temporary directories.
• Add code-review checks to discourage predictable temporary-file use and unsafe ZIP extraction patterns.
• Monitor for suspicious pre-created files or ownership mismatches in temporary directories used by affected applications, especially around application execution times.