Path Traversal in Matrix-org Matrix-js-sdk
CVE-2024-50336
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-j…
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.009 (75.7th percentile) — read the EPSS interpretation.
Affected products
- Matrix-org Matrix-js-sdk — versions < 34.11.1
Weakness classification (CWE)
References
- https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr (x_refsource_CONFIRM)
- https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5 (x_refsource_MISC)