16 matches found
PYSEC-2026-1841 Pyrofork has a Path Traversal in download_media Method
Summary The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal...
Path Traversal
Pyrofork is vulnerable to Path Traversal. The vulnerability is due to improper sanitization of filenames received from Telegram messages in the downloadmedia method, which allows an attacker to supply a malicious filename via DocumentAttributeFilename and perform path traversal during file path...
CVE-2025-67720
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
Directory Traversal
Overview pyrofork is a Fork of pyrogram. Elegant, modern and asynchronous Telegram MTProto API framework in Python for users and bots Affected versions of this package are vulnerable to Directory Traversal via the progress' function in the downloadmedia.py file. An attacker can overwrite or creat...
CVE-2025-67720
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
EUVD-2025-202593
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
CVE-2025-67720
CVE-2025-67720 affects Pyrofork, an asynchronous MTProto API framework for Python. The vulnerability occurs in the download_media path when a user-supplied Telegram filename is used to construct the target path without adequate sanitization. Versions 2.3.68 and earlier may fall back to the media’...
CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
pyrofork 路径遍历漏洞
pyrofork is an interface framework open-sourced by Mayuri-Chan. A path traversal vulnerability exists in pyrofork 2.3.68 and earlier versions, which stems from not properly cleaning up filenames and can lead to file path construction issues...
CVE-2025-67720: Improper Limitation of a Pathname to a Restricted Directory
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
GHSA-6H2F-WJHF-4WJX Pyrofork has a Path Traversal in download_media Method
Summary The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal...
Malicious code in pyrofork-dev (PyPI)
--- -= Per source details. Do not edit below this line.=-...