CVE-2025-67720: Pyrofork Path Traversal Vulnerability in download_media Method
Summary
CVE-2025-67720: Pyrofork has a Path Traversal in download_media Method. Affects pyrofork versions < 2.3.69. Fixed in 2.3.69. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pyrofork is a Python library designed for interacting with the Telegram API, allowing developers to create bots and automate tasks. It provides various methods for handling media, including downloading files sent in messages. However, the library has a critical vulnerability in its download_media method, which fails to properly sanitize filenames, leading to potential path traversal attacks.
Vulnerability Detail
The vulnerability in Pyrofork arises from the download_media method, which uses filenames from Telegram messages without adequate sanitization. An attacker can exploit this by sending a crafted document with path traversal sequences (e.g., '../') or absolute paths in the filename. This allows the attacker to write files to arbitrary locations on the filesystem, potentially leading to unauthorized access or modification of sensitive files. The issue is rooted in the reliance on user-controlled input for file naming, combined with insufficient checks against path traversal.
How To Fix
Latest published version: 2.3.69 as of 23 Oct 2026
pip install --upgrade "pyrofork==2.3.69"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually specify a safe filename when calling the download_media method, ensuring it does not contain any path traversal sequences. For example: 'await client.download_media(message, "safe_filename.txt")'.
Conclusion
The CVE-2025-67720 vulnerability in Pyrofork poses a significant risk due to its path traversal nature, allowing attackers to manipulate file paths. It is crucial for users to update to the latest version of the package and implement proper filename sanitization to protect against potential exploits.
See every vulnerability recorded for pyrofork →
FAQ
The vulnerability allows for path traversal, enabling attackers to write files to arbitrary locations on the filesystem.
Any Telegram bot or user account using Pyrofork that downloads media without specifying a custom filename is at risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation could lead to arbitrary file writes, overwriting existing files, and potentially executing malicious code if the bot runs with elevated privileges.
You can mitigate the risk by specifying safe filenames when downloading media and avoiding the use of default parameters.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyrofork.
