CVE-2025-32948CWE-843

PeerTube ActivityPub Playlist Creation Blind SSRF and DoS

High · published April 15, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00601 · 48.1th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-04-15T14:50Z
EPSS history
Timeline
  • 15 APR 14:50Z
    PeerTube ActivityPub Playlist Creation Blind SSRF and DoS
    cvelistv5