CVE-2026-25645

CVE-2026-25645 affects the Python Requests library (versions prior to 2.33.0), specifically its `extract_zipped_paths()` utility function. A local attacker with write access to the system temporary directory can exploit predictable filenames to pre-create and load malicious files in place of legitimate ones. This vulnerability carries a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity that could lead to high integrity impact. However, only applications directly calling the vulnerable function are affected, not standard Requests library usage. There is no evidence of active exploitation, public exploit code, or inclusion in CISA's KEV catalog, though a GitHub mention indicates a fix.