How severe is CVE-2026-25645?

CVE-2026-25645 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-25645 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-25645?

CVE-2026-25645 affects Python Requests. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-25645?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-25645 have an EU (EUVD) identifier?

Yes. CVE-2026-25645 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-15754.

When was CVE-2026-25645 published?

CVE-2026-25645 was published on 2026-03-25 and last updated on 2026-06-17.

CVE-2026-25645

CVE-2026-25645 is a medium-severity vulnerability in Python Requests with a CVSS 3.x base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-377.

Key facts

Severity: Medium (CVSS 3.x base score 4.4)
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-15754
Weakness: CWE-377
Affected product: Python Requests
Published: 2026-03-25
Last modified: 2026-06-17

Description

Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

Frequently asked questions

What is CVE-2026-25645?: Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.
How severe is CVE-2026-25645?: CVE-2026-25645 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-25645 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-25645?: CVE-2026-25645 affects Python Requests. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-25645?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-25645 have an EU (EUVD) identifier?: Yes. CVE-2026-25645 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-15754.
When was CVE-2026-25645 published?: CVE-2026-25645 was published on 2026-03-25 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:python:requests:*:*:*:*:*:*:*:*

More vulnerabilities in Python Requests

CVE-2018-18074 — High (CVSS 7.5): The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a…
CVE-2015-2296 — Medium (CVSS 6.8): The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct…
CVE-2023-32681 — Medium (CVSS 6.1): Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination…
CVE-2014-1830 — Medium (CVSS 5.0): Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the…
CVE-2014-1829 — Medium (CVSS 5.0): Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the…

All CVEs affecting Python Requests →

Other CWE-377 (Insecure Temporary File) vulnerabilities

CVE-2011-4119 — Critical (CVSS 9.8): caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
CVE-2012-2666 — Critical (CVSS 9.8): golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a…
CVE-2015-5224 — Critical (CVSS 9.8): The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name…
CVE-2025-14307 — High (CVSS 8.1): An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The…
CVE-2023-43498 — High (CVSS 8.1): In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates…
CVE-2025-46369 — High (CVSS 7.8): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File…

Browse all CWE-377 (Insecure Temporary File) vulnerabilities →