CVE-2025-32943: PeerTube HLS Video Files Path Traversal
Published Apr 15, 2025
·Updated
The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traversal in the HLS endpoint.
Affected Software
2 affected components
PeerTube PeerTube
Framasoft Peertube<7.1.1
Event History
Apr 15, 2025
CVE Published
via MITRE·10:24 AM
Data Sourced
via MITRE·10:24 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-32943?
CVE-2025-32943 is classified as a high severity vulnerability due to the potential for data leakage from the PeerTube server.
2
How do I fix CVE-2025-32943?
To fix CVE-2025-32943, update PeerTube to version 7.1.1 or later, which addresses the path traversal vulnerability.
3
Who is affected by CVE-2025-32943?
Any instance of PeerTube that allows authenticated users can be affected by CVE-2025-32943.
4
What type of data can be leaked due to CVE-2025-32943?
CVE-2025-32943 allows the leak of arbitrary '.m3u8' files, which can contain sensitive streaming configuration data.
5
How does CVE-2025-32943 exploit path traversal?
CVE-2025-32943 exploits path traversal by allowing malicious authenticated users to manipulate file paths in HLS endpoint requests.