CVE-2022-0726

CVE-2022-0726 concerns PeerTube versions prior to 4.1.0 with a missing/improper authorization issue in the chocobozzz/peertube repository. The connected documents specify that unauthenticated or insufficiently authorized actions allow attackers to interact with private videos by creating new comm...

CVE-2022-0881

CVE-2022-0881 concerns insecure storage of sensitive information in the GitHub repository chocobozzz/peertube, affected up to version 4.1.1. The root cause is insecure handling/storage of sensitive data within the project, leading to potential information disclosure. Public sources (NVD, Red Hat,...

CVE-2022-0727

CVE-2022-0727 affects chocobozzz/peertube (prior to version 4.1.0) with improper access control. The Red Hat/ENISA/CNVD/OSV/etc. entries and the Huntr PoC confirm the root cause: the app does not properly check video status when making data changes, enabling a user to rate private videos via API ...

CVE-2025-32946

PeerTube Arbitrary Playlist Creation via ActivityPub (CVE-2025-32946) allows one user to add playlists to another user’s channel due to a missing permission check when handling ActivityPub requests. The vulnerability is triggered when the code assigns the playlist owner to the requester while ass...

CVE-2022-0508

PeerTube (chocobozzz/peertube) is affected by a Server-Side Request Forgery (SSRF) vulnerability described in CVE-2022-0508, stemming from insufficient verification of request origin for server-side requests prior to the commit f33e515991a32885622b217bf2ed1d1b0d9d6832. Connected sources (Red Hat,...

CVE-2025-32943

Summary (peer-reviewed sources confirm): CVE-2025-32943 affects PeerTube’s HLS endpoint, where a path traversal flaw allows any authenticated user to leak contents of arbitrary ".m3u8" files from the server. The vulnerability is rooted in improper input handling on the HLS path, enabling access t...

CVE-2025-32944

CVE-2025-32944 affects PeerTube where, if user import is enabled, any authenticated user can upload an archive. The vulnerability stems from the yauzl archive reader: when it encounters an illegal filename, it raises an exception that PeerTube does not catch, causing a crash that repeats on start...

CVE-2021-3780

CVE-2021-3780 is an XSS vulnerability in Peertube. Multiple connected sources describe a stored XSS in Peertube, stemming from insufficient input validation/filtering, affecting versions prior to v3.4.0. An attacker could upload an SVG image and then share its URL to cause JavaScript execution in...

CVE-2022-0170

CVE-2022-0170 affects chocobozzz/peertube with an Improper Access Control issue. Connected docs confirm exploitation where unauthenticated users can obtain comments on private videos (e.g., via /api/v1/videos/{id}/comment-threads). No specific affected versions, root cause details, or remediation...

CVE-2025-32945

PeerTube CVE-2025-32945: A REST API flaw allows an authenticated user to add playlists to another user’s channel. The code creates the playlist with the requester as owner and sets the channel to the supplied ID without verifying ownership, enabling cross-user playlist creation. CVSS v3.1 base sc...

CVE-2022-0132

CVE-2022-0132: SSRF in chocobozzz/peertube confirmed across multiple feeds (NVD, Red Hat, CNVD, OSV, CVE listings). Description consistently states PeerTube suffers from SSRF due to insufficient validation of user input, enabling an attacker to craft URLs and reach internal resources. Impact desc...

CVE-2025-32949

PeerTube is affected by an authenticated resource-exhaustion vulnerability in the User Import feature when handling archives. The issue occurs because the archive-reading library yauzl has no mechanism to detect or prevent Zip Bombs, allowing a Zip Bomb to cause extremely large disk-space consump...

CVE-2025-32947

CVE-2025-32947 concerns PeerTube. The connected documents describe a DoS via an infinite loop in the "+inbox+" endpoint triggered by crafted ActivityPub activities, causing the PeerTube server to stop responding to requests. Affected software is PeerTube; the root cause is an infinite loop in han...

CVE-2025-32948

PeerTube (inbox via ActivityPub) is affected by CVE-2025-32948, where mishandling of Create Activity can be abused to crash the server or trigger blind SSRF by sending crafted ActivityPub activities to the inbox. The vulnerability arises from handling ActivityPub activities in playlists, enabling...

CVE-2022-0133

CVE-2022-0133 affects chocobozzz/peertube. Root cause: improper access control that can expose resources to unauthorized users. Practical impact (supported by connected sources): captions of private PeerTube videos can be fetched by unauthenticated users via the API (e.g., /api/v1/videos/{id}/cap...