CVE-2025-32949
📋 TL;DR
This vulnerability allows any authenticated user to upload a Zip Bomb archive that causes disk space exhaustion when PeerTube attempts to extract it. The issue affects PeerTube instances with user import functionality enabled, which is the default configuration. Attackers can fill the server's disk space, potentially causing service disruption.
💻 Affected Systems
- PeerTube
📦 What is this software?
Peertube by Framasoft
⚠️ Risk & Real-World Impact
Worst Case
Complete disk space exhaustion leading to service outage, data corruption, and inability to process legitimate user uploads.
Likely Case
Partial disk space consumption causing performance degradation and potential service disruption until manual cleanup.
If Mitigated
Minimal impact if user import is disabled or disk quotas are enforced.
🎯 Exploit Status
Exploitation requires authenticated user access. Zip Bomb creation tools are widely available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v7.1.1
Vendor Advisory: https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1
Restart Required: Yes
Instructions:
1. Backup your PeerTube instance. 2. Update to PeerTube v7.1.1 or later. 3. Restart the PeerTube service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable User Import
allDisable the user import functionality to prevent archive uploads.
Edit PeerTube configuration to set user import to disabled
Implement Disk Quotas
linuxSet disk usage limits for the PeerTube process or user.
# Linux example using ulimit
ulimit -f 1000000
# Or implement filesystem quotas
🧯 If You Can't Patch
- Disable user import functionality immediately
- Implement strict disk monitoring and alerting for unusual consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check if PeerTube version is below v7.1.1 and user import is enabled.Check Version:
Check PeerTube admin panel or run: npm list --depth=0 | grep peertubeVerify Fix Applied:
Confirm PeerTube version is v7.1.1 or later and test user import with safe archives.📡 Detection & Monitoring
Log Indicators:
- Unusually large archive extraction attempts
- Rapid disk space consumption alerts
- User import process failures
Network Indicators:
- Large archive uploads via user import endpoint
SIEM Query:
source="peertube" AND ("user.import" OR "archive.extract") AND size>100MB