Listen to this Post
The vulnerability exists because the `download_media` method does not sanitize the `file_name` attribute from incoming Telegram messages. This attribute originates from the sender-controlled DocumentAttributeFilename. When a user downloads media without specifying a custom filename, the code falls back to using this untrusted value. The `os.path.split()` function separates the user-provided directory path from the filename. If the directory path is provided but the filename is empty, the code uses the attacker-controlled media_file_name. An existing check for absolute paths (os.path.isabs()) fails to catch relative paths containing directory traversal sequences like ../. Subsequently, `os.path.join()` and `os.path.abspath()` combine the directory with the malicious filename. This constructs a final filesystem path that escapes the intended download directory, allowing arbitrary file writes to locations accessible by the bot process.
DailyCVE Form
Platform: Pyrofork (Pyrogram fork)
Version: Affects multiple versions
Vulnerability: Path Traversal
Severity: Critical
Date: 2025-12-11
Prediction: Patch expected soon
What Undercode Say
Bash Commands and Codes:
Simulating the vulnerable path construction
python3 -c "
import os
media_file_name = '../../../tmp/malicious'
directory, file_name = os.path.split('downloads/')
file_name = file_name or media_file_name
print('Unsanitized path:', os.path.join(str(directory), file_name))
"
Key vulnerable code segment from download_media.py media_file_name = getattr(media, 'file_name', '') directory, file_name = os.path.split(file_name) file_name = file_name or media_file_name or '' Missing sanitization here allows traversal temp_file_path = os.path.abspath(os.path.join(directory, file_name)) + '.temp'
How Exploit:
An attacker sends a Telegram document with a filename containing path traversal sequences (e.g., ../../../etc/passwd). When the victim bot or user downloads this media using the common `await client.download_media(message)` pattern without a custom filename, the file is written outside the intended `downloads/` directory to the attacker-specified location.
Protection from this CVE
Recommended fix: Sanitize filename after line 151
file_name = file_name or media_file_name or ''
if file_name:
file_name = os.path.basename(file_name) Strip directory paths
file_name = file_name.replace('\x00', '')
if not file_name or file_name in ('.', '..'):
file_name = ''
Impact:
Arbitrary file write. Potential denial-of-service. Possible remote code execution if the bot process has high privileges or writes to sensitive locations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
