CyberRota Analysis
AI-GeneratedPeerTube versions prior to 8.2.2 are vulnerable to unauthorized modifications of video metadata and visibility due to insufficient validation of ActivityPub Update requests. This critical flaw allows a malicious federated server to alter video information, potentially leading to data manipulation and privacy breaches. Administrators of PeerTube instances should prioritize updating to version 8.2.2 or later to mitigate this severe risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.