CVE-2025-67720

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the download_media method before using them in file path construction. When downloading media, if the user does not specify a custom filename (which is the common/default usage), the method falls back to using the file_name attribute from the media object. The attribute originates from Telegram's DocumentAttributeFilename and is controlled by the message sender. This issue is fixed in version 2.3.69.

• CWE-22

• https://github.com/Mayuri-Chan/pyrofork/commit/2f2d515575cc9c360bd74340a61a1d2b1e1f1f95
• https://github.com/Mayuri-Chan/pyrofork/security/advisories/GHSA-6h2f-wjhf-4wjx

Published

Dec 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67715Weblate is a web based localization tool. In versions prior …4.3
• CVE-2025-67716The Auth0 Next.js SDK is a library for implementing user aut…5.7
• CVE-2025-67717ZITADEL is an open-source identity infrastructure tool. Vers…4.3
• CVE-2025-67718Form.io is a combined Form and API platform for Serverless a…8.7
• CVE-2025-67719Ibexa is a composable end-to-end DXP (Digital Experience Pla…8.5
• CVE-2025-6772A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2…7.5
• CVE-2025-67721Aircompressor is a library with ports of the Snappy, LZO, LZ…7.5
• CVE-2025-67722FreePBX is an open-source web-based graphical user interface…7.8
• CVE-2025-67723Discourse is an open source discussion platform. Versions pr…5.4
• CVE-2025-67724Tornado is a Python web framework and asynchronous networkin…6.1
• CVE-2025-67725Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-67726Tornado is a Python web framework and asynchronous networkin…7.5