Medium, CVSS 6.5PyPIAmendedPublished
Pyrofork has a Path Traversal in download_media Method
CVE-2025-67720 · GHSA-6h2f-wjhf-4wjx
- Affected
- PyPI pyrofork <= 2.3.68
- Fixed in
- 2.3.69· Vendor fix available
- Issue
- The downloadmedia method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal sequences (e.g., ../) or absolute paths in the filename. --- Details When downloading media, if the user does not specify a custom filename (which is the common/default usage), the method falls back to using the filename attribute from the media object. This attribute originates from Telegram's DocumentAttributeFilename and is controlled by the message sender. Vulnerable Code Path Step 1: In pyrogram/methods/messages/downloadmedia.py (lines 145-151): When a user calls downloadmedia(message) or downloadmedia(message, "downloads/"), the os.path.split() returns an empty filename, causing the code to use mediafilename which is attacker-controlled. Step 2: In pyrogram/client.py (line 1125): The…
Recommended action: Upgrade to 2.3.69 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.