Threats tagged 'brew-icloudpd-cve-2026-25645'

The Requests library's utility function extract_zipped_paths() in icloudpd versions from 1.17.3 up to but not including 1.33.0 uses predictable filenames when extracting zip archive contents to the system temporary directory. This allows a local attacker with write access to the temp directory to pre-create malicious files that could be reused by the function, leading to potential code or data injection. Standard usage of the Requests library is not affected; only direct calls to extract_zipped_paths() are vulnerable. The issue is fixed in icloudpd version 1.33.0.