---
schema_version: '1.0'
id: security-20260705-10b9a9
url: https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2
url_hash: 10b9a9749f79c3d51705050ef2cbca2ffbfc386b5be8b8ec2b5264dd0b6c3ce9
canonical_url: https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-25645
- GHSA-gc5v-m9x4-r6x2
- severity:CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
- requests
- PyPI
lang: en
published_at: '2026-03-25T16:56:28Z'
fetched_at: '2026-07-05T15:34:34Z'
updated_at: '2026-07-11T06:37:45Z'
status: published
content_hash: 86bbe943d583e876a5da45a2d1a1b8304905cd795e8b7742a7e926e6fedd0e88
license_note: full
summary: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility
  function
summary_source: rss
summary_en: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility
  function
entities:
- name: HashTag
  type: concept
- name: CarloBuontempo
  type: person
related_auto:
- name: SustainableQuantumComputing
  type: concept
  weight: 3.0
title: 'CVE-2026-25645: Requests has Insecure Temp File Reuse in its extract_zipped_paths()
  utility function'
---

# CVE-2026-25645: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

## TL;DR
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

## Key Points
- cve / CVE-2026-25645 / GHSA-gc5v-m9x4-r6x2 / severity:CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N / requests / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
**Advisory:** GHSA-gc5v-m9x4-r6x2 (CVE-2026-25645)

**Affected (your watchlist):**
- `PyPI:requests` 2.31.0 → fixed in 2.33.0 [docker/docker-strands+docker/local+docker/mac]
- `PyPI:requests` 2.32.3 → fixed in 2.33.0 [mac]
- `PyPI:requests` 2.32.5 → fixed in 2.33.0 [docker/docker-llmwiki]

**Details:**
### Impact
The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.

### Affected usages
**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.

### Remediation
Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.

If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

**References:**
- https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2
- https://nvd.nist.gov/vuln/detail/CVE-2026-25645
- https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7
- https://github.com/psf/requests
- https://github.com/psf/requests/releases/tag/v2.33.0

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2_

## Source
元記事: [CVE-2026-25645: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function](https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2) — published 2026-03-25T16:56:28Z