ZeroDay Findings
Sign inSign up

Findings

CVE-2026-25645

Requests is a HTTP library.

Published Mar 25, 2026 · updated Jun 17, 2026 · python requests

Requests is a HTTP library. Prior to version 2.33.0, the utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set in their environment to a directory with restricted write access.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 25, 2026 · NIST NVD

    Detected

    Requests is a HTTP library. Prior to version 2.33.0, the utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard

  2. Jun 17, 2026 · NIST NVD

    Updated

    Requests is a HTTP library. Prior to version 2.33.0, the utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard

Affected

  • cpe python/requestsversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-25645

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-25645

    Requests is a HTTP library. Prior to version 2.33.0, the utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without valid

    nvd.nist.gov

References