CVE-2025-67720

Vulnerability

Overview

CVE-2025-67720 is a path traversal vulnerability in Pyrofork, an asynchronous MTProto API framework for Telegram. The download_media method in versions 2.3.68 and earlier does not sanitize filenames received from Telegram messages before using them in file path construction. When a[1]. When a user downloads media without specifying a custom filename (the common default usage), the method falls back to using the file_name attribute from the media object, which originates from Telegram's DocumentAttributeFilename and is controlled by the message sender [1][2].

Exploitation

Details

An attacker can exploit this by sending a specially crafted document with path traversal sequences (e.g., ../) or absolute paths in the filename [1]. The vulnerable code path occurs in pyrogram/methods/messages/download_media.py where os.path.split() returns an empty filename when the user provides only a directory path, causing the code to use the attacker-controlled media_file_name [1]. The subsequent os.path.join() call does not prevent path traversal, allowing the attacker to write files outside the intended download directory [1]. The existing check for absolute paths is insufficient because it only handles absolute paths by skipping the directory prefix, but relative paths with ../ bypass this check [1].

Impact

A remote attacker can write files to arbitrary locations on the filesystem of the user running Pyrofork [1]. This could lead to overwriting critical files, planting malicious scripts, or other unauthorized file operations depending on the permissions of the Pyrofork process [1]. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) with a CVSS v3 score of 6.5 (Medium) [1][2].

Mitigation

The issue is fixed in Pyrofork version 2.3.69 [1][2]. The fix, implemented in commit 2f2d515, sanitizes filenames by removing path components using os.path.basename(), removing null bytes, and handling edge cases like empty or dot filenames [4]. Users should upgrade to version 2.3.69 or later to mitigate this vulnerability [1][2].