CVE-2025-32948
PeerTube ActivityPub Playlist Creation Blind SSRF and DoS
- State
- Published
- Severity
- 7.5 High
- Published
- Apr 15, 2025
- Updated
- Apr 15, 2025
- Reserved
- Apr 14, 2025
Description
The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | JFROG |
Weaknesses
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected Products
| Product | Versions |
|---|---|
Chocobozzz/PeerTube |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.