CVE-2025-32948: PeerTube ActivityPub Playlist Creation Blind SSRF and DoS
The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32948?
CVE-2025-32948 has a high severity level due to its potential to cause a denial of service and facilitate unauthorized URL requests.
How do I fix CVE-2025-32948?
The recommended fix for CVE-2025-32948 is to upgrade to the latest version of PeerTube, specifically version 7.1.1 or higher.
What type of attack is described in CVE-2025-32948?
CVE-2025-32948 describes a blind Server-Side Request Forgery (SSRF) attack that can lead to the PeerTube server becoming non-functional.
Which components of PeerTube are affected by CVE-2025-32948?
CVE-2025-32948 affects the "inbox" endpoint of PeerTube's ActivityPub implementation.
Can CVE-2025-32948 be exploited remotely?
Yes, CVE-2025-32948 can be exploited remotely by sending crafted ActivityPub activities to the PeerTube server.