CVE-2025-32943 | THREATINT

Description

The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traversal in the HLS endpoint.

PUBLISHED Reserved 2025-04-14 | Published 2025-04-15 | Updated 2025-04-15 | Assigner JFROG

LOW: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status

unaffected

Any version before 7.1.1

affected

References

research.jfrog.com/...abilities/peertube-hls-path-traversal/ exploit

github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1 patch

research.jfrog.com/...abilities/peertube-hls-path-traversal/ third-party-advisory

cve.org (CVE-2025-32943)

nvd.nist.gov (CVE-2025-32943)

Download JSON