FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Matrix clients -- mxc uri validation in js sdk

Affected packages
	cinny	<	4.2.3
	element-web	<	1.11.85

Details

VuXML ID	574f7bc9-a141-11ef-84e9-901b0e9408dc
Discovery	2024-11-12
Entry	2024-11-12

matrix-js-sdk upstream reports:

matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver.

[source]

References

CVE Name	CVE-2024-50336
URL	https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr