CVE-2025-32948 PeerTube ActivityPub Playlist Creation Blind SSRF and DoS
Attackers can cause denial of service or blind SSRF in PeerTube by sending crafted ActivityPub Create activities to the inbox endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32948?
CVE-2025-32948 is a high-severity server-side request forgery vulnerability in framasoft:peertube, published on 15 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.
Weakness: CWE-843
Which versions are affected by CVE-2025-32948?
It affects 1 product.
Products include Framasoft Peertube.
How do I fix CVE-2025-32948?
No fix has been published for CVE-2025-32948 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-32948 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32948 exists.
Other vulnerabilities in framasoft:peertube
- CVE-2022-0881 Insecure Storage of Sensitive Information in chocobozzz/peertube
- CVE-2021-3780 Cross-site Scripting (XSS) - Stored in chocobozzz/peertube
- CVE-2025-32947 PeerTube ActivityPub Crawl Infinite Loop DoS
- CVE-2025-32944 PeerTube User Import Authenticated Persistent Denial of Service
- CVE-2025-32949 PeerTube User Import Authenticated Resource Exhaustion
Sources
Also known as GHSA-jhgf-xqjm-37vh.