87818 matches found
CVE-2025-67720
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
CVE-2025-55816
creationtimestamp| type| source ---|---|--- 2025-12-11 21:00:06+00:00| published-proof-of-concept| Telegram/0R1sh6yTM6RpS889fQ8OVezlutCC6wifTf5dIyVUqSNUZo...
CVE-2025-66470
creationtimestamp| type| source ---|---|--- 2025-12-11 21:00:06+00:00| published-proof-of-concept| Telegram/0R1sh6yTM6RpS889fQ8OVezlutCC6wifTf5dIyVUqSNUZo...
Directory Traversal
Overview pyrofork is a Fork of pyrogram. Elegant, modern and asynchronous Telegram MTProto API framework in Python for users and bots Affected versions of this package are vulnerable to Directory Traversal via the progress' function in the downloadmedia.py file. An attacker can overwrite or creat...
CVE-2025-67720
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
CVE-2025-67720
CVE-2025-67720 affects Pyrofork, an asynchronous MTProto API framework for Python. The vulnerability occurs in the download_media path when a user-supplied Telegram filename is used to construct the target path without adequate sanitization. Versions 2.3.68 and earlier may fall back to the media’...
CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
CVE-2025-67720: Improper Limitation of a Pathname to a Restricted Directory
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...
CVE-2025-57462
creationtimestamp| type| source ---|---|--- 2025-12-10 21:00:05+00:00| published-proof-of-concept| Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg...
CVE-2025-57459
creationtimestamp| type| source ---|---|--- 2025-12-10 21:00:05+00:00| published-proof-of-concept| Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg...
CVE-2025-57460
creationtimestamp| type| source ---|---|--- 2025-12-10 21:00:05+00:00| published-proof-of-concept| Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg...
GHSA-6H2F-WJHF-4WJX Pyrofork has a Path Traversal in download_media Method
Summary The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal...
Pyrofork has a Path Traversal in download_media Method
Summary The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal...
CVE-2025-62993
Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.5.1...
CVE-2025-65742
creationtimestamp| type| source ---|---|--- 2025-12-10 14:21:16+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/62424...
CVE-2025-49173
creationtimestamp| type| source ---|---|--- 2025-12-10 09:00:05+00:00| published-proof-of-concept| Telegram/b0MrL-7YyNVMwlRE8cQmf3aSFWZZuNk0ErN3GEJH-SnDaRk...
PT-2025-50567
Name of the Vulnerable Software and Affected Versions Pyrofork versions 2.3.68 and earlier Description Pyrofork is an asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages before using them in file path construction with...