CVE-2025-32944

MEDIUM EPSS 37.8%

Published Apr 15, 20251y ago · Modified Jun 17, 20262w ago

6.5 CVSS 3.1

Medium

Published Apr 15, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.

CVSS Details

Base Score

6.5

Exploitability

2.8

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

37.8% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-248

Affected Products 1

Vendor	Product	Version	Range
framasoft	peertube	*	<7.1.1

References 2

github.com https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1

Release Notes
research.jfrog.com https://research.jfrog.com/vulnerabilities/peertube-archive-persistent-dos/

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.