Path Traversal

Pyrofork is vulnerable to Path Traversal. The vulnerability is due to improper sanitization of filenames received from Telegram messages in the downloadmedia method, which allows an attacker to supply a malicious filename via DocumentAttributeFilename and perform path traversal during file path...

CVE-2025-67720

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

Directory Traversal

Overview pyrofork is a Fork of pyrogram. Elegant, modern and asynchronous Telegram MTProto API framework in Python for users and bots Affected versions of this package are vulnerable to Directory Traversal via the progress' function in the downloadmedia.py file. An attacker can overwrite or creat...

d4rktg (>=0.0.1 <=1.5.8), reposter (>=24.3.5 <=24.3.8) potentially affected by CVE-2025-67720 via pyrofork (>=2.3.45 <=2.3.68)

pyrofork PYPI version =2.3.45, =0.0.1, =24.3.5, =24.3.8 Source cves: CVE-2025-67720 Source advisory: SNYK:PYTHON-PYROFORK-14361685...

CVE-2025-67720

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-67720

CVE-2025-67720 affects Pyrofork, an asynchronous MTProto API framework for Python. The vulnerability occurs in the download_media path when a user-supplied Telegram filename is used to construct the target path without adequate sanitization. Versions 2.3.68 and earlier may fall back to the media’...

EUVD-2025-202593

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

pyrofork 路径遍历漏洞

pyrofork is an interface framework open-sourced by Mayuri-Chan. A path traversal vulnerability exists in pyrofork 2.3.68 and earlier versions, which stems from not properly cleaning up filenames and can lead to file path construction issues...

GHSA-6H2F-WJHF-4WJX Pyrofork has a Path Traversal in download_media Method

Summary The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal...

d4rktg (>=0.0.1 <=1.5.8), reposter (>=24.3.5 <=24.3.8) potentially affected by CVE-2025-67720 via pyrofork (>=2.3.45 <=2.3.68)

pyrofork PYPI version =2.3.45, =0.0.1, =24.3.5, =24.3.8 Source cves: CVE-2025-67720 Source advisory: OSV:GHSA-6H2F-WJHF-4WJX...

Malicious code in pyrofork-dev (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6572 Malicious code in pyrofork-dev (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in pyroforktgcrypto-pyrofork (PyPI)

--- -= Per source details. Do not edit below this line.=-...