CVE-2025-32948
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Apr 15, 2025
CWE ID 843
Summary
CVE-2025-32948 is a vulnerability affecting PeerTube servers. It enables attackers to send malicious ActivityPub activities to the "inbox" endpoint, leading to denial-of-service (DoS) attacks or Blind Server-Side Request Forgery (Blind SSRF). Attackers can exploit the "Create Activity" functionality to craft playlists that trigger these unwanted outcomes, causing PeerTube servers to stop functioning or allowing attackers to send requests to arbitrary URLs. This issue poses a significant security risk for PeerTube installations.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- PeerTube