CVE-2026-25645 - Zip Path Extraction Vulnerability in Python Requests (Easy-to-Understand Overview)

If you use the popular Python Requests library for HTTP requests, you should know about CVE-2026-25645. This security issue doesn't affect the main way people use Requests, but it can put custom applications at risk. The trouble is with the requests.utils.extract_zipped_paths() utility function, which helps unpack files from zip archives.

Here’s the problem: before version 2.33., this function saves extracted files to a predictable file path in the temporary directory. That makes it easy for an attacker on the same system (like on a multi-user server) to guess or create those files in advance. If you extract a file and the attacker already dropped a malicious file with the same name where Requests looks, you end up loading their file instead of the one you expect. That’s called a “local privilege escalation” or “insecure temp file” bug.

The Requests team patched this starting in version 2.33. by extracting files to random paths, so attackers can't predict them.

You are NOT affected if you just use requests.get(), post(), or similar standard functions.

- You are vulnerable if you directly call requests.utils.extract_zipped_paths(). That’s not common, but some specialized tools or frameworks might do it.

Technical Explanation with Example Code

Let’s look at a simple Python example that shows the risky behavior. Imagine you have code like this (prior to version 2.33.):

import zipfile
from requests.utils import extract_zipped_paths

# This is your ZIP file, uploaded from somewhere
zip_path = '/tmp/uploaded_archive.zip'

# Extract using the vulnerable function
with zipfile.ZipFile(zip_path) as zf:
    extracted_files = extract_zipped_paths(zf)

print("Extracted files:", extracted_files)

The hidden problem:
- The function writes extracted files to something like /tmp/extracted_data.
- If another user (attacker) puts a file at /tmp/extracted_data, your code will use theirs instead of extracting a fresh copy.
- If that attacker-made file contains unexpected code (say, a Python module), your app might import or run it.

Local attacker puts a malicious file:

The attacker creates a fake file with the right name in the /tmp folder before your application tries to extract the zip.

You run your application:

When your code calls extract_zipped_paths(), it finds the attacker’s file and uses it, thinking it’s safe.

Malicious code loads:

If your app reads or executes code from that file, the attacker gets code execution, privilege escalation, or steals data.

Suppose the attacker does

echo "evil code" > /tmp/extracted_data

Then your Python code tries to extract a file called extracted_data. It will see the attacker's "evil code" file and use that, not the real one from the ZIP!

Recommendations and Workarounds

Best fix:

Upgrade to Requests 2.33. or later.

Download from pypi.org/project/requests.

Short-term workaround:
- Set the TMPDIR environment variable to a directory that only trusted users can write to before running your app:

`bash

export TMPDIR=/secure/tmp

python yourscript.py

 - Only run code that calls extract_zipped_paths() in trusted, isolated environments. --- ## References & Further Reading - GitHub Advisory for Requests: GHSA-v9xj-m97p-9f39 - Requests 2.33. Release Notes - CVE-2026-25645 Details at NVD *(Link will be live after NVD publishes)* --- ## Summary - CVE-2026-25645 is about unsafe use of temp files when extracting zip files with extract_zipped_paths()` in Python Requests.
- Standard usage of Requests is NOT affected.
- If you (or a library you use) calls this function directly: upgrade to 2.33.+ immediately.
- As a temporary fix, use a temp directory only you (and trusted users) can write to.

Stay safe — always patch quickly and be careful with anything that unpacks files!

Timeline

Published on: 03/25/2026 17:02:48 UTC
Last modified on: 03/30/2026 14:23:16 UTC