PT-2026-28069 · Pypi+1 · Requests+1

Jaycelation · Published 2026-03-25 · Updated 2026-05-24 · CVE-2026-25645

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Requests versions prior to 2.33.0

Description The requests.utils.extract zipped paths() function uses a predictable filename when extracting files from zip archives into the system temporary directory. If a file with the same name already exists, it is reused without validation. A local attacker with write access to the temporary directory could pre-create a malicious file that would be loaded in place of the legitimate one. This impacts applications that directly call extract zipped paths(). The function requests.utils.extract zipped paths() is used by HTTPAdapter.cert verify() to load the CA bundle.

Recommendations Versions prior to 2.33.0 should be upgraded to version 2.33.0 or later. If upgrading is not possible, set the TMPDIR environment variable to a directory with restricted write access.

Exploit

Fix

Weakness Enumeration

CWE-377

Related Identifiers

BDU:2026-07739

CVE-2026-25645

ECHO-74D4-CC6F-7870

GHSA-GC5V-M9X4-R6X2

OESA-2026-1909

OPENSUSE-SU-2026:10455-1

SUSE-SU-2026:1218-1

SUSE-SU-2026:1644-1

SUSE-SU-2026:1647-1

SUSE-SU-2026:21036-1

SUSE-SU-2026:21063-1

Affected Products

Red Os

Requests

References · 42

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25645.json · Exploit
• https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7 · Patch
• https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25645 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1218-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-25645 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-25645 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-25645 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25645 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:21063-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10455-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25645 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1909 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25645 · Vendor Advisory