CVE-2025-67720

Description

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the download_media method before using them in file path construction. When downloading media, if the user does not specify a custom filename (which is the common/default usage), the method falls back to using the file_name attribute from the media object. The attribute originates from Telegrams DocumentAttributeFilename and is controlled by the message sender. This issue is fixed in version 2.3.69.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS Score

Exploitation Probability

0.049

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-67720 are fixed in Python-pyrofork 2.3.69	Windows
Vulnerabilities CVE-2025-67720 are fixed in Python-pyrofork for linux 2.3.69	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234