CVE-2025-67720: 
Python vulnerability analysis and mitigation

CVE-2025-67720 is a path traversal vulnerability (CWE-22) in Pyrofork, a modern asynchronous MTProto API framework for Telegram. The flaw exists in the download_media method, which fails to sanitize attacker-controlled filenames received from Telegram messages before using them in file path construction. All versions up to and including 2.3.68 are affected; the issue was fixed in version 2.3.69. The advisory was published on December 10, 2025, with a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is improper input validation (CWE-22) in pyrogram/methods/messages/download_media.py. When a user calls download_media(message) without specifying a custom filename, the method falls back to using the file_name attribute from the Telegram media object (DocumentAttributeFilename), which is fully controlled by the message sender. The vulnerable code path uses os.path.split() on the user-supplied path parameter, yielding an empty filename that triggers the fallback to the attacker-controlled value; subsequently, os.path.join(directory, file_name) followed by os.path.abspath() in pyrogram/client.py (line 1125) resolves path traversal sequences (e.g., ../../../etc/passwd) without restriction. An existing os.path.isabs() check is insufficient because it does not catch relative traversal sequences. A public PoC script demonstrating the exact vulnerable logic is included in the security advisory (GitHub Advisory, Fix Commit).

Successful exploitation allows a remote attacker to write files to arbitrary locations on the filesystem accessible by the bot process, limited only by the process's OS-level write permissions. This can result in overwriting critical application files, configuration files, or other sensitive data, compromising system integrity. In deployments where the bot runs with elevated privileges, arbitrary file write could escalate to remote code execution (e.g., by overwriting scripts or cron jobs). Confidentiality and availability are not directly impacted per the CVSS assessment, but integrity impact is rated High (GitHub Advisory).

A public proof-of-concept script is included in the official security advisory, demonstrating the vulnerability using the exact vulnerable code logic. Exploitation requires the attacker to be able to send a Telegram message with a crafted DocumentAttributeFilename to the target bot or user account, and the victim application must call download_media without specifying a custom filename — the default and most common usage pattern. The EPSS score is approximately 0.048% (15th percentile), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory).

1. Identify target: Locate a Telegram bot or user account built with Pyrofork ≤2.3.68 that downloads received media using the default await client.download_media(message) pattern.
2. Craft malicious document: Prepare a Telegram document (any file type) and set its DocumentAttributeFilename to a path traversal payload such as ../../../tmp/malicious_file or an absolute path like /etc/cron.d/backdoor.
3. Send the message: Send the crafted document to the target bot or user account via Telegram. No special privileges are required — any Telegram account that can message the target is sufficient.
4. Trigger download: Wait for or induce the bot to call download_media on the received message without a custom filename argument. The vulnerable fallback logic will use the attacker-supplied filename.
5. Achieve arbitrary file write: The os.path.join() + os.path.abspath() combination resolves the traversal sequences, writing the downloaded file content to the attacker-specified path outside the intended download directory (e.g., /tmp/malicious_file instead of /app/downloads/malicious_file) (GitHub Advisory).

• File System: Unexpected files appearing outside the configured download directory (e.g., in /tmp/, /etc/, or other system directories) with names matching Telegram media filenames; files with .temp extension in unexpected locations during download operations.
• Logs: Application logs showing download_media calls where the resolved file path does not begin with the expected download directory; Python tracebacks or warnings related to file write operations in unexpected paths.
• Process: Bot process writing files to directories outside its normal working directory or designated download folder, observable via filesystem auditing tools (e.g., auditd, inotifywait) (GitHub Advisory).

Upgrade Pyrofork to version 2.3.69 or later, which applies os.path.basename() to strip all directory components from attacker-supplied filenames, removes null bytes, and handles edge cases (., ..) before path construction (Fix Commit). As a short-term workaround for those unable to upgrade immediately, always pass an explicit, sanitized filename to download_media rather than relying on the default fallback (e.g., await client.download_media(message, file_name="downloads/safe_name.bin")). Additionally, run bot processes with the minimum necessary filesystem permissions to limit the impact of any successful exploitation.