CVE-2025-32943 PeerTube HLS Video Files Path Traversal
Authenticated users can exploit a path traversal in the HLS endpoint to read arbitrary .m3u8 files from the PeerTube server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32943?
CVE-2025-32943 is a low-severity path traversal vulnerability in framasoft:peertube, published on 15 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traversal in the HLS endpoint.
Weakness: CWE-22
Which versions are affected by CVE-2025-32943?
It affects 1 product.
Products include Framasoft Peertube.
How do I fix CVE-2025-32943?
No fix has been published for CVE-2025-32943 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-32943 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32943 exists.
Other vulnerabilities in framasoft:peertube
- CVE-2022-0881 Insecure Storage of Sensitive Information in chocobozzz/peertube
- CVE-2021-3780 Cross-site Scripting (XSS) - Stored in chocobozzz/peertube
- CVE-2025-32947 PeerTube ActivityPub Crawl Infinite Loop DoS
- CVE-2025-32948 PeerTube ActivityPub Playlist Creation Blind SSRF and DoS
- CVE-2025-32944 PeerTube User Import Authenticated Persistent Denial of Service
Sources
Also known as GHSA-7gg5-pghg-4cqq.