Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.4.4 enhancement update

CVE-2026-25645 describes a vulnerability in the Requests library's extract_zipped_paths() utility function, which extracts files from zip archives into the system temporary directory using predictable filenames. If a file already exists at the target location, it is reused without validation, enabling a local attacker with write permissions on the temp directory to pre-create malicious files that may be loaded instead of legitimate ones. This vulnerability affects only applications that call extract_zipped_paths() directly; standard Requests library usage is not impacted. The vulnerability has a CVSS score of 4.4 (medium severity). A fix is available in Requests 2.33.0, which changes extraction to a non-deterministic location. As a workaround, setting the TMPDIR environment variable to a directory with restricted write access can reduce risk.

The vulnerability allows a local attacker with write access to the system temporary directory to substitute malicious files in place of legitimate extracted files when extract_zipped_paths() is used directly. This can lead to integrity violations (high impact on integrity) but does not affect confidentiality or availability. Standard Requests library usage is not affected, limiting the scope of impact.

Upgrade to Requests version 2.33.0 or later, where the extraction process uses a non-deterministic temporary location, mitigating the vulnerability. If upgrading is not possible, set the TMPDIR environment variable to a directory with restricted write permissions to prevent unauthorized file creation in the temp directory.