Local File Extraction Vulnerability in Requests HTTP Library by PSF

CVE-2026-25645

What is CVE-2026-25645?

The Requests HTTP library prior to version 2.33.0 contains a local file extraction vulnerability within the requests.utils.extract_zipped_paths() function. This issue arises when the library attempts to extract a Certificate Authority (CA) bundle file, utilizing a predictable filename (e.g., cacert.pem) for temporary storage in the system's /tmp directory. Instead of using secure methods to verify the file's content or ensuring unique extraction, the vulnerable logic checks for existing files and reuses them. This behavior allows local attackers to preemptively create a malicious CA bundle file in the /tmp directory, which could be exploited by applications running with elevated privileges, thereby compromising security.

References