PT-2025-16351 · Yauzl+1 · Yauzl+1

Ori Hollander · Published 2025-04-15 · Updated 2025-04-15 · CVE-2025-32949

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PeerTube (affected versions not specified)

Description This issue allows any authenticated user to cause the server to consume large amounts of disk space by extracting a Zip Bomb. When user import is enabled, which is the default setting, any registered user can upload an archive for importing. The yauzl library used for reading the archive lacks a mechanism to detect or prevent extraction of a Zip Bomb, leading to disk space resource exhaustion when using the User Import functionality with a Zip Bomb.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2025-32949

Affected Products

Peertube

Yauzl

References · 8

• 🔥 https://research.jfrog.com/vulnerabilities/peertube-archive-resource-exhaustion · Exploit
• https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-32949 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32949 · Vendor Advisory
• https://t.me/cvetracker/21642 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1912185912902975619 · Twitter Post
• https://t.me/cvedetector/22971 · Telegram Post
• https://twitter.com/CVEnew/status/1912163026037260723 · Twitter Post