CVE-2025-32949mediumCWE-409

CVE-2025-32949: medium-severity vulnerability in Chocobozzz/PeerTube

PeerTube User Import Authenticated Resource Exhaustion

Published

Follow this CVE+ Monitor Chocobozzz/PeerTube

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.6%
This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a Zip Bomb https://en.wikipedia.org/wiki/Zip_bomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource exhaustion.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Chocobozzz/PeerTube
Related CVEs — Chocobozzz/PeerTube

In the same product, most dangerous first.

CVE-2025-32947HIGHPeerTube ActivityPub Crawl Infinite Loop DoSEPSS 0.8%CVE-2025-32948HIGHPeerTube ActivityPub Playlist Creation Blind SSRF and DoSEPSS 0.6%CVE-2025-32944MEDIUMPeerTube User Import Authenticated Persistent Denial of ServiceEPSS 0.6%CVE-2025-32943LOWPeerTube HLS Video Files Path TraversalEPSS 0.5%CVE-2025-32946MEDIUMPeerTube Arbitrary Playlist Creation via ActivityPub ProtocolEPSS 0.4%CVE-2025-32945MEDIUMPeerTube Arbitrary Playlist Creation via REST APIEPSS 0.3%