Approved changes feed: RSS · Atom
cpe:2.3:a:mayuri-chan:pyrofork:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mayuri Chan (edcabfae-7e1e-58a4-949e-f5601cc88992) |
|---|---|
| Product | Pyrofork (b17d26a9-96a5-5f04-b8df-5d6ee9a3610e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-67720 |
vulnerable | 2026-06-08 07:41:20.360831 |
Pyrofork has a Path Traversal in download_media Method
MEDIUM (6.5)
Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the download_media method before using them in file path construction. When downloading media, if the user does not specify a custom filename (which is the common/default usage), the method falls back to using the file_name attribute from the media object. The attribute originates from Telegram's DocumentAttributeFilename and is controlled by the message sender. This issue is fixed in version 2.3.69.
Published: 2025-12-11T01:25:46.459Z
Updated: 2025-12-11T15:35:02.068Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.