CVE-2025-32944: medium-severity vulnerability in Chocobozzz/PeerTube
PeerTube User Import Authenticated Persistent Denial of Service
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.6%
The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Chocobozzz/PeerTubeRelated CVEs — Chocobozzz/PeerTube
In the same product, most dangerous first.
CVE-2025-32947HIGHPeerTube ActivityPub Crawl Infinite Loop DoSEPSS 0.8%CVE-2025-32948HIGHPeerTube ActivityPub Playlist Creation Blind SSRF and DoSEPSS 0.6%CVE-2025-32949MEDIUMPeerTube User Import Authenticated Resource ExhaustionEPSS 0.6%CVE-2025-32943LOWPeerTube HLS Video Files Path TraversalEPSS 0.5%CVE-2025-32946MEDIUMPeerTube Arbitrary Playlist Creation via ActivityPub ProtocolEPSS 0.4%CVE-2025-32945MEDIUMPeerTube Arbitrary Playlist Creation via REST APIEPSS 0.3%