5.5

CVE-2026-25645: psf requests Insecure Temporary File

CVSS: 5.5v3.1MediumAnalyzed
AliasesALPINE-CVE-2026-25645SUSE-SU-2026:1218-1SUSE-SU-2026:21036-1
Published 25-03-2026Last modified 25-03-2026
Open JSON

Vulnerability summary

CVE-2026-25645 is a medium (CVSS 5.5) Insecure Temporary File vulnerability in psf requests. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.6% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-XJWQ-GMV4-JM7W

Timeline

  1. 25-03-2026
    PublishedVulnerability first disclosed.
  2. 25-03-2026
    Last modifiedVulnerability information updated.

Description

Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

8%

Versus all other CVEs

30-day change

0.00 pp

From 0.18% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard139 products
  • airflow-2< 2.11.2-r5
  • airflow-3< 3.1.8-r10
  • airflow-core-2< 2.11.2-r3
  • airflow-core-3< 3.1.8-r3
  • ansible-operator< 1.42.2-r2 | < 1.42.2-r1
Wolfi53 products
  • airflow-3< 3.1.8-r10
  • az< 2.84.0-r4
  • checkov< 3.2.511-r0
  • confluent-docker-utils< 0.0.169-r1
  • dask-kubernetes< 2026.3.0-r2
Ubuntu2 products
  • python-pipAll versions (No fix recorded)
  • requests< 2.22.0-2ubuntu1.1+esm2 | < 2.25.1+dfsg-2ubuntu0.4 | < 2.31.0+dfsg-1ubuntu1.2 | All versions (No fix recorded) | < 2.32.5+dfsg-1ubuntu1.1
Alpine1 product
  • py3-requests< 2.33.1-r0
Debian1 product
  • requestsAll versions (No fix recorded) | < 2.34.2-1
Opensuse1 product
  • python-requests&distro=openSUSE Leap 16.0< 2.32.4-160000.3.1
Psf1 product
PyPI1 product
  • requests< 2.33.0
Python1 product

9 vendors · 200 products · Showing 200 of 208. Use Open JSON for the complete list.

References

18 links
Show all 18 references