CVE-2025-32948

Published: Apr 15, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: reefs@jfrog.com (Secondary)

Description

The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.

Affected (1)

Products: Framasoft: Peertube

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Framasoft Peertube	Before 7.1.1

Related CWEs

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (2)

https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1

Source: reefs@jfrog.com

Release Notes

https://research.jfrog.com/vulnerabilities/peertube-activitypub-playlist-creation-blind-ssrf-dos/

Source: reefs@jfrog.com

ExploitThird Party Advisory

Timeline

No history available yet.