{
  "cveId": "CVE-2026-25645",
  "url": "https://patchblox.com/security/cve/CVE-2026-25645",
  "summary": "CVE-2026-25645 is fixed in 8 products on 1 platform, first by python3-requests 2.22.0-2ubuntu1.1\u002Besm2, released March 25, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",
  "description": "Requests is a HTTP library. Prior to version 2.33.0, the \u0060requests.utils.extract_zipped_paths()\u0060 utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call \u0060extract_zipped_paths()\u0060 directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set \u0060TMPDIR\u0060 in their environment to a directory with restricted write access.",
  "published": "2026-03-25T10:16:00Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "cwe": "Insecure Temporary File",
  "epss": 0.00189,
  "epssPercentile": 0.08624,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25645",
  "fixes": [
    {
      "platform": "linux",
      "product": "python-pulp-glue",
      "release": "Fedora 43",
      "fixedVersion": "0.37.0-5.fc43",
      "fix": "FEDORA-2026-8AD863685A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-8ad863685a",
      "released": "2026-05-08T13:47:41Z"
    },
    {
      "platform": "linux",
      "product": "python-requests",
      "release": "Fedora 43",
      "fixedVersion": "2.33.1-1.fc43",
      "fix": "FEDORA-2026-8AD863685A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-8ad863685a",
      "released": "2026-05-08T13:47:41Z"
    },
    {
      "platform": "linux",
      "product": "python-requests",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.32.4-160000.3.1",
      "fix": "OPENSUSE-SU-2026:20926-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20926-1",
      "released": "2026-06-08T16:38:34Z"
    },
    {
      "platform": "linux",
      "product": "python-requests",
      "release": "sles 16.0",
      "fixedVersion": "2.32.4-160000.3.1",
      "fix": "SUSE-SU-2026:22091-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22091-1",
      "released": "2026-06-08T16:27:21Z"
    },
    {
      "platform": "linux",
      "product": "python3-pulp-glue",
      "release": "Fedora 43",
      "fixedVersion": "0.37.0-5.fc43",
      "fix": "FEDORA-2026-8AD863685A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-8ad863685a",
      "released": "2026-05-08T13:47:41Z"
    },
    {
      "platform": "linux",
      "product": "python3-requests",
      "release": "Fedora 43",
      "fixedVersion": "2.33.1-1.fc43",
      "fix": "FEDORA-2026-8AD863685A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-8ad863685a",
      "released": "2026-05-08T13:47:41Z"
    },
    {
      "platform": "linux",
      "product": "python3-requests",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2.22.0-2ubuntu1.1\u002Besm2",
      "fix": "python3-requests 2.22.0-2ubuntu1.1\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-requests-2.22.0-2ubuntu1.1-esm2",
      "released": "2026-03-25T10:16:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-requests",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.25.1\u002Bdfsg-2ubuntu0.4",
      "fix": "python3-requests 2.25.1\u002Bdfsg-2ubuntu0.4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-requests-2.25.1-dfsg-2ubuntu0.4",
      "released": "2026-03-25T10:16:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-requests",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.31.0\u002Bdfsg-1ubuntu1.2",
      "fix": "python3-requests 2.31.0\u002Bdfsg-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-requests-2.31.0-dfsg-1ubuntu1.2",
      "released": "2026-03-25T10:16:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-requests",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "2.32.5\u002Bdfsg-1ubuntu1.1",
      "fix": "python3-requests 2.32.5\u002Bdfsg-1ubuntu1.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-python3-requests-2.32.5-dfsg-1ubuntu1.1",
      "released": "2026-03-25T10:16:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-requests\u002Bsecurity",
      "release": "Fedora 43",
      "fixedVersion": "2.33.1-1.fc43",
      "fix": "FEDORA-2026-8AD863685A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-8ad863685a",
      "released": "2026-05-08T13:47:41Z"
    },
    {
      "platform": "linux",
      "product": "python3-requests\u002Bsocks",
      "release": "Fedora 43",
      "fixedVersion": "2.33.1-1.fc43",
      "fix": "FEDORA-2026-8AD863685A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-8ad863685a",
      "released": "2026-05-08T13:47:41Z"
    },
    {
      "platform": "linux",
      "product": "python3-requests\u002Buse_chardet_on_py3",
      "release": "Fedora 43",
      "fixedVersion": "2.33.1-1.fc43",
      "fix": "FEDORA-2026-8AD863685A",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-8ad863685a",
      "released": "2026-05-08T13:47:41Z"
    },
    {
      "platform": "linux",
      "product": "requests",
      "release": "Debian 14",
      "fixedVersion": "2.34.2-1",
      "fix": "DEBIAN-CVE-2026-25645",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-25645",
      "released": "2026-03-25T17:16:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}