---
schema_version: '1.0'
id: security-20260714-dbffd8
url: https://osv.dev/vulnerability/PYSEC-2026-2275
url_hash: dbffd82c37c367f5b2e4581ad7677bf89ba264b4d02bc775743381f93269e07a
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2275
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-25645
- PYSEC-2026-2275
- severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- requests
- PyPI
lang: en
published_at: '2026-03-25T17:16:52Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:44:25Z'
status: published
content_hash: d6d809d608a6bb214516b9a8a2f91863d932750cc6510988959c386e8999da99
license_note: full
summary: Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()`
  utility function uses a predictable filename when extracting files from zip archives
  into the system temporary directory. If the target file already exists, it is reused
  without valid
summary_source: rss
summary_en: Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()`
  utility function uses a predictable filename when extracting files from zip archives
  into the system temporary directory. If the target file already exists, it is reused
  without valid
entities:
- name: requests
  type: artifact
key_facts: []
related: []
related_auto: []
title: CVE-2026-25645 — requests
---

# CVE-2026-25645 — requests

## TL;DR
Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without valid

## Key Points
- cve / CVE-2026-25645 / PYSEC-2026-2275 / severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N / requests / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
**Advisory:** PYSEC-2026-2275 (CVE-2026-25645)

**Affected (your watchlist):**
- `PyPI:requests` 2.31.0 → fixed in 2.33.0 [docker/docker-strands+docker/local+docker/mac]
- `PyPI:requests` 2.32.3 → fixed in 2.33.0 [mac]
- `PyPI:requests` 2.32.5 → fixed in 2.33.0 [docker/docker-llmwiki]

**Details:**
Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

**References:**
- https://github.com/psf/requests/releases/tag/v2.33.0
- https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2
- https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2275_

## Source
元記事: [CVE-2026-25645 — requests](https://osv.dev/vulnerability/PYSEC-2026-2275) — published 2026-03-25T17:16:52Z