Asynchronous MTProto API Framework Vulnerability in Pyrofork
CVE-2025-67720

6.5MEDIUM

Key Information:

Vendor

Mayuri-chan

Status
Pyrofork
Vendor
CVE Published:
11 December 2025

What is CVE-2025-67720?

Pyrofork, an asynchronous MTProto API framework, contains a vulnerability wherein it fails to properly sanitize filenames derived from Telegram messages within the download_media method. This flaw arises when the user opts for the default filename setting, allowing the file_name attribute from Telegram's DocumentAttributeFilename—controlled by the message sender—to be utilized in constructing file paths. This oversight poses potential risks as unsanitized filenames may lead to unauthorized file access or code execution. The issue has been addressed and resolved in version 2.3.69.

Affected Version(s)

pyrofork < 2.3.69

References

https://github.com/Mayuri-Chan/pyrofork/security/advisori...
x_refsource_CONFIRM
https://github.com/Mayuri-Chan/pyrofork/commit/2f2d515575...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-67720 : Asynchronous MTProto API Framework Vulnerability in Pyrofork