PT-2025-50567 · Pyrofork · Pyrofork

Published 2025-12-11 · Updated 2025-12-12 · CVE-2025-67720

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pyrofork versions 2.3.68 and earlier

Description Pyrofork is an asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages before using them in file path construction within the download media method. When downloading media without a custom filename, the method uses the file name attribute from the media object, which originates from Telegram’s DocumentAttributeFilename and is controlled by the message sender. This can lead to a path traversal issue.

Recommendations Update to version 2.3.69 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-67720

GHSA-6H2F-WJHF-4WJX

Affected Products

Pyrofork

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67720.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-67720 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67720 · Security Note
• https://github.com/Mayuri-Chan/pyrofork/security/advisories/GHSA-6h2f-wjhf-4wjx · Note
• https://github.com/Mayuri-Chan/pyrofork/commit/2f2d515575cc9c360bd74340a61a1d2b1e1f1f95 · Note
• https://reddit.com/r/VulnMatter/comments/1pkvele/resumen_diario_de_vulnerabilidades_12122025 · Reddit Post
• https://t.me/cveNotify/145402 · Telegram Post
• https://t.me/CVEtracker/39436 · Telegram Post
• https://twitter.com/CVEnew/status/1999108885672861790 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1999042992343044180 · Twitter Post