CVE-2025-32949mediumCWE-409

CVE-2025-32949: falha de média gravidade em Chocobozzz/PeerTube

PeerTube User Import Authenticated Resource Exhaustion

Publicada em

Seguir esta CVE+ Monitorar Chocobozzz/PeerTube

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.6%
This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a Zip Bomb https://en.wikipedia.org/wiki/Zip_bomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource exhaustion.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Chocobozzz/PeerTube
CVEs relacionadas — Chocobozzz/PeerTube

No mesmo produto, das mais perigosas para as menos.

CVE-2025-32947HIGHPeerTube ActivityPub Crawl Infinite Loop DoSEPSS 0.8%CVE-2025-32948HIGHPeerTube ActivityPub Playlist Creation Blind SSRF and DoSEPSS 0.6%CVE-2025-32944MEDIUMPeerTube User Import Authenticated Persistent Denial of ServiceEPSS 0.6%CVE-2025-32943LOWPeerTube HLS Video Files Path TraversalEPSS 0.5%CVE-2025-32946MEDIUMPeerTube Arbitrary Playlist Creation via ActivityPub ProtocolEPSS 0.4%CVE-2025-32945MEDIUMPeerTube Arbitrary Playlist Creation via REST APIEPSS 0.3%