CVE-2025-32948

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-32948
The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1 Release Notes
https://research.jfrog.com/vulnerabilities/peertube-activitypub-playlist-creation-blind-ssrf-dos/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:framasoft:peertube:*:*:*:*:*:*:*:*
History

21 Oct 2025, 16:26

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad permite a cualquier atacante provocar la interrupción del funcionamiento del servidor de PeerTube o, en casos especiales, enviar solicitudes a URL arbitrarias (SSRF ciega). Los atacantes pueden enviar actividades de ActivityPub al endpoint de "inbox" de PeerTube. Al abusar de la función "Create Activity", es posible crear listas de reproducción manipuladas que provocarán una denegación de servicio o una SSRF ciega controlada por el atacante.
CPE cpe:2.3:a:framasoft:peertube:*:*:*:*:*:*:*:*
First Time Framasoft peertube
Framasoft
References () https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1 - () https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1 - Release Notes
References () https://research.jfrog.com/vulnerabilities/peertube-activitypub-playlist-creation-blind-ssrf-dos/ - () https://research.jfrog.com/vulnerabilities/peertube-activitypub-playlist-creation-blind-ssrf-dos/ - Exploit, Third Party Advisory

15 Apr 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-15 15:16

Updated : 2025-10-21 16:26

NVD link : CVE-2025-32948

Mitre link : CVE-2025-32948

CVE.ORG link : CVE-2025-32948

JSON object : View

Products Affected

framasoft

  • peertube
CWE
CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')