Skip to content
Heist/ feed
Back to feed
High

PeerTube ActivityPub Playlist Creation Blind SSRF and DoS

Type: advisorySources: OSV

The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-32948
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 08:58 UTC · Revision 1

Source evidence

PeerTube ActivityPub Playlist Creation Blind SSRF and DoS

core-osv · Original source

Published 15 Apr 2025, 14:50 UTC

The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.

osv:CVE-2025-32948
Complete source record
{
  "id": "6738351573777c3dca5f38e951462607fd65b135148ab74f8e00c4d0ada73792",
  "url": "https://osv.dev/vulnerability/CVE-2025-32948",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "PeerTube ActivityPub Playlist Creation Blind SSRF and DoS",
    "summary": "The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's \"inbox\" endpoint. By abusing the \"Create Activity\" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.",
    "evidence": "osv:CVE-2025-32948",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-32948",
      "aliases": [
        "CVE-2025-32948"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/chocobozzz/peertube",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "b9c3a4837e6a5e5d790e55759e3cf2871df4f03c"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.1.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b9c3a4837e6a5e5d790e55759e3cf2871df4f03c"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v7.1.1"
                  },
                  {
                    "cpe": "cpe:2.3:a:framasoft:peertube:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.1.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v7.1.0",
            "v7.1.0-rc.1",
            "v7.0.1",
            "v7.0.0",
            "v7.0.0-rc.1",
            "v6.3.1",
            "v6.3.0",
            "v6.3.0-rc.1",
            "v6.2.1",
            "v6.2.0",
            "v6.2.0-rc.1",
            "v6.1.0",
            "v6.1.0-rc.1",
            "v6.0.2",
            "v6.0.1",
            "v6.0.0",
            "v6.0.0-rc.2",
            "v6.0.0-rc.1",
            "v5.2.0",
            "v5.2.0-rc.1",
            "v5.1.0-rc.1",
            "v5.0.0",
            "v5.0.0-rc.1",
            "v4.3.0",
            "v4.3.0-rc.1",
            "v4.2.0-rc.1",
            "v4.1.0",
            "v4.1.0-rc.1",
            "v4.0.0-rc.1",
            "v3.4.0",
            "v3.4.0-rc.1",
            "v3.3.0",
            "v3.3.0-rc.1",
            "v3.1.0-rc.1",
            "v3.0.0",
            "v3.0.0-rc.1",
            "v2.4.0",
            "v2.4.0-rc.1",
            "v2.3.0-rc.1",
            "v2.2.0-rc.1",
            "v2.1.0-rc.1",
            "v2.0.0",
            "v2.0.0-rc.1",
            "v1.4.0-rc.1",
            "v1.3.0-rc.1",
            "v1.1.0",
            "v1.1.0-rc.1",
            "v1.1.0-alpha.1",
            "v1.0.0-rc.2",
            "v1.0.0-rc.1",
            "v1.0.0-beta.16",
            "v1.0.0-beta.15",
            "v1.0.0-beta.14",
            "v1.0.0-beta.13",
            "v1.0.0-beta.12",
            "v1.0.0-beta.11",
            "v1.0.0-beta.10.pre.3",
            "v1.0.0-beta.10.pre.2",
            "v1.0.0-beta.10.pre.1",
            "v1.0.0-beta.9",
            "v1.0.0-beta.8",
            "v1.0.0-beta.7",
            "v1.0.0-beta.6",
            "v1.0.0-beta.5",
            "v1.0.0-beta.4",
            "v1.0.0-beta.3",
            "v1.0.0-beta.2",
            "v1.0.0-beta.1",
            "v1.0.0-alpha.10",
            "v1.0.0-alpha.9",
            "v1.0.0-alpha.8",
            "v1.0.0-alpha.7",
            "v1.0.0-alpha.6",
            "v1.0.0-alpha.5",
            "v1.0.0-alpha.4",
            "v1.0.0-alpha.3",
            "v1.0.0-alpha.2",
            "v1.0.0-alpha.1",
            "v0.0.29-alpha",
            "v0.0.28-alpha",
            "v0.0.27-alpha",
            "v0.0.23-alpha",
            "v0.0.22-alpha",
            "v0.0.21-alpha",
            "v0.0.20-alpha",
            "v0.0.19-alpha",
            "v0.0.18-alpha",
            "v0.0.17-alpha",
            "v0.0.16-alpha",
            "v0.0.14-alpha",
            "v0.0.13-alpha",
            "v0.0.12-alpha",
            "v0.0.11-alpha",
            "v0.0.9-alpha",
            "v0.0.8-alpha",
            "v0.0.6-alpha",
            "v0.0.5-alpha",
            "v0.0.4-alpha",
            "v0.0.3-alpha"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32948.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.517580475Z",
      "provider": "osv",
      "references": [
        "https://github.com",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32948.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-32948",
        "https://research.jfrog.com/vulnerabilities/peertube-activitypub-playlist-creation-blind-ssrf-dos/",
        "https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-843"
        ],
        "cna_assigner": "JFROG",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32948.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-32948",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 518828,
  "published_at": "2025-04-15T14:50:09.204+00:00"
}