CVE-2025-32949 PeerTube User Import Authenticated Resource Exhaustion

Medium 6.5 Published 15 Apr 2025 Updated 15 Apr 2025

Authenticated users can exhaust server disk space by uploading Zip Bomb archives via the default-enabled user import feature.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-32949?

CVE-2025-32949 is a medium-severity denial of service vulnerability in framasoft:peertube, published on 15 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb.

If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a Zip Bomb https://en.wikipedia.org/wiki/Zip_bomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource exhaustion.

Weakness: CWE-409

Which versions are affected by CVE-2025-32949?

It affects 1 product.

Products include Framasoft Peertube.

How do I fix CVE-2025-32949?

No fix has been published for CVE-2025-32949 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-32949 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32949 exists.

Sources

Also known as GHSA-89c2-gvr7-7r9w.