CVE-2025-66470

creationtimestamp| type| source ---|---|--- 2025-12-11 21:00:06+00:00| published-proof-of-concept| Telegram/0R1sh6yTM6RpS889fQ8OVezlutCC6wifTf5dIyVUqSNUZo...

Directory Traversal

Overview pyrofork is a Fork of pyrogram. Elegant, modern and asynchronous Telegram MTProto API framework in Python for users and bots Affected versions of this package are vulnerable to Directory Traversal via the progress' function in the downloadmedia.py file. An attacker can overwrite or creat...

CVE-2025-67720

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-67720

CVE-2025-67720 affects Pyrofork, an asynchronous MTProto API framework for Python. The vulnerability occurs in the download_media path when a user-supplied Telegram filename is used to construct the target path without adequate sanitization. Versions 2.3.68 and earlier may fall back to the media’...

CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-57462

creationtimestamp| type| source ---|---|--- 2025-12-10 21:00:05+00:00| published-proof-of-concept| Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg...

CVE-2025-57460

creationtimestamp| type| source ---|---|--- 2025-12-10 21:00:05+00:00| published-proof-of-concept| Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg...

CVE-2025-57459

creationtimestamp| type| source ---|---|--- 2025-12-10 21:00:05+00:00| published-proof-of-concept| Telegram/HZ3ZJRsPXN2xbtsA1DCWruuU-3EwXxx0KgUeziJX8Cuevwg...

GHSA-6H2F-WJHF-4WJX Pyrofork has a Path Traversal in download_media Method

Summary The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal...

Pyrofork has a Path Traversal in download_media Method

Summary The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal...

CVE-2025-62993

Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.5.1...

CVE-2025-65742

creationtimestamp| type| source ---|---|--- 2025-12-10 14:21:16+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/62424...

CVE-2025-49173

creationtimestamp| type| source ---|---|--- 2025-12-10 09:00:05+00:00| published-proof-of-concept| Telegram/b0MrL-7YyNVMwlRE8cQmf3aSFWZZuNk0ErN3GEJH-SnDaRk...

PT-2025-50567

Name of the Vulnerable Software and Affected Versions Pyrofork versions 2.3.68 and earlier Description Pyrofork is an asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages before using them in file path construction with...

CVE-2025-65754

creationtimestamp| type| source ---|---|--- 2025-12-09 21:00:05+00:00| published-proof-of-concept| Telegram/qJ94TH8UxM1mvjtBkVVanzfaRAufPLEJcbQaTg-CgcLSXM...

EUVD-2025-202010

Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.4.7...

CVE-2025-62993

Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through = 3.5.1...

CVE-2025-62993

CVE-2025-62993 concerns WordPress plugin Notification for Telegram (plugin slug: notification-for-telegram) with versions up to and including 3.4.7. The Red Hat/EUVD/NVD/NIST entries describe a Missing Authorization vulnerability (Broken Access Control) arising from incorrectly configured access ...