CVE-2025-32949

Katalog CVE

CVSS 6.5 · Medium EPSS 0,56%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification) pada framasoft peertube. Skor CVSS 3.1 6.5 (Medium) menurut jfrog.com.

Deskripsi (NVD)

This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a Zip Bomb https://en.wikipedia.org/wiki/Zip_bomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource exhaustion.

Rincian

Terbit di NVD

15 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber jfrog.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://research.jfrog.com/vulnerabilities/peertube-archive-resource-exhaustion/ exploit · advisory pihak ketiga
• https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1 release notes