matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

Description

matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client’s homeserver.

Recommendation

Update the matrix-js-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 34.11.1
• Patched version(s): 34.11.1

References

• GHSA-xvg8-m4x3-w6xr
• spec.matrix.org
• lists.debian.org
• CVE-2024-50336
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
• Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414
• Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
• Nuxt Devtools has a Path Traversal: '../filedir - CVE-2024-23657

Tags:

npm

matrix-js-sdk