CVE-2025-32949: PeerTube User Import Authenticated Resource Exhaustion
This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb.
If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a Zip Bomb https://en.wikipedia.org/wiki/Zipbomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource exhaustion.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32949?
The severity of CVE-2025-32949 is high as it allows authenticated users to exploit the system for resource exhaustion.
How do I fix CVE-2025-32949?
To fix CVE-2025-32949, ensure user import is disabled or implement size restrictions on uploaded archives.
Who is affected by CVE-2025-32949?
CVE-2025-32949 affects any instance of PeerTube where user import functionality is enabled.
What is a Zip Bomb in relation to CVE-2025-32949?
A Zip Bomb is a malicious file designed to consume excessive resources when decompressed, which CVE-2025-32949 exploits.
Can CVE-2025-32949 lead to data loss?
While CVE-2025-32949 primarily causes resource exhaustion, it can potentially lead to service disruptions or data loss.