CVE-2025-32949: PeerTube User Import Authenticated Resource Exhaustion
First published: Tue Apr 15 2025(Updated: )
This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a Zip Bomb https://en.wikipedia.org/wiki/Zip_bomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource exhaustion.
Credit: reefs@jfrog.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PeerTube |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-32949?
The severity of CVE-2025-32949 is high as it allows authenticated users to exploit the system for resource exhaustion.
How do I fix CVE-2025-32949?
To fix CVE-2025-32949, ensure user import is disabled or implement size restrictions on uploaded archives.
Who is affected by CVE-2025-32949?
CVE-2025-32949 affects any instance of PeerTube where user import functionality is enabled.
What is a Zip Bomb in relation to CVE-2025-32949?
A Zip Bomb is a malicious file designed to consume excessive resources when decompressed, which CVE-2025-32949 exploits.
Can CVE-2025-32949 lead to data loss?
While CVE-2025-32949 primarily causes resource exhaustion, it can potentially lead to service disruptions or data loss.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/peertube
- canonical/peertube