Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

19 records

Vendor: chocobozzz Clear all filters
TI-2025-23960 CVE-2025-32949 · GHSA-89c2-gvr7-7r9w

PeerTube User Import Authenticated Resource Exhaustion

Priority MEDIUM 62

This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00573 Published 2025-04-15 Fixed in 7.1.1 CWE-409
TI-2025-23959 CVE-2025-32948 · GHSA-jhgf-xqjm-37vh

PeerTube ActivityPub Playlist Creation Blind SSRF and DoS

Priority HIGH 72

The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00601 Published 2025-04-15 Fixed in 7.1.1 CWE-843
TI-2025-23958 CVE-2025-32947 · GHSA-3w69-j4hp-rvh4

PeerTube ActivityPub Crawl Infinite Loop DoS

Priority HIGH 72

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00759 Published 2025-04-15 Fixed in 7.1.1 CWE-835
TI-2025-23957 CVE-2025-32946 · GHSA-6f46-45q7-4jx2

PeerTube Arbitrary Playlist Creation via ActivityPub Protocol

Priority MEDIUM 63

This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0038 Published 2025-04-15 Fixed in 7.1.1 CWE-282
TI-2025-23956 CVE-2025-32945 · GHSA-9gxm-gppf-g7cc

PeerTube Arbitrary Playlist Creation via REST API

Priority MEDIUM 53

The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00324 Published 2025-04-15 Fixed in 7.1.1 CWE-282
TI-2025-23955 CVE-2025-32944 · GHSA-fvpc-gqmr-784w

PeerTube User Import Authenticated Persistent Denial of Service

Priority MEDIUM 62

The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00594 Published 2025-04-15 Fixed in 7.1.1 CWE-248
TI-2025-23954 CVE-2025-32943 · GHSA-7gg5-pghg-4cqq

PeerTube HLS Video Files Path Traversal

Priority MEDIUM 53

The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traversal in the HLS endpoint.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00517 Published 2025-04-15 Fixed in 7.1.1 CWE-22
TI-2022-00640 CVE-2022-0727 · GHSA-vrv5-28j8-rv7x

Improper Access Control in chocobozzz/peertube

Priority LOW 26

Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00678 Published 2022-02-23 Fixed in 4.1.0 CWE-284
TI-2022-00639 CVE-2022-0726 · GHSA-ch9f-gc54-7j46

Missing Authorization in chocobozzz/peertube

Priority LOW 26

Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00678 Published 2022-02-23 Fixed in 4.1.0 CWE-862
TI-2022-00428 CVE-2022-0508 · GHSA-mv26-cx23-vrfg

Server-Side Request Forgery (SSRF) in chocobozzz/peertube

Priority LOW 26

Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00893 Published 2022-02-08 Fixed in f33e515991a32885622b217bf2ed1d1b0d9d6832, 4.1.0-rc.1 CWE-918
TI-2022-00111 CVE-2022-0170 · GHSA-7frq-94mg-4f64

Improper Access Control in chocobozzz/peertube

Priority LOW 21

peertube is vulnerable to Improper Access Control

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00706 Published 2022-01-11 Fixed in Not released yet CWE-284
TI-2021-02711 CVE-2021-3780 · GHSA-f2c5-997w-7f5c

Cross-site Scripting (XSS) - Stored in chocobozzz/peertube

Priority LOW 29

peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00899 Published 2021-09-15 Fixed in 3.4.0 CWE-79