CVE-2025-67720 Details

A path traversal vulnerability has been identified in Pyrofork, an asynchronous MTProto API framework, in versions through 2.3.68. The issue arises in the 'download_media' method, which fails to properly sanitize filenames received from Telegram messages before using them to construct file paths. This flaw allows remote attackers to write files to arbitrary locations on the filesystem by sending documents with specially crafted filenames that include path traversal sequences or absolute paths. The vulnerability is exploited when the method is used with default filename settings, relying on the 'file_name' attribute controlled by the message sender.

Users can upgrade to Pyrofork version 2.3.69, which addresses the vulnerability by sanitizing filenames to prevent path traversal. The recommended sanitization process involves removing any path components to keep only the basename, eliminating null bytes, and handling edge cases where the filename may be empty or contain only directory references.