CVE-2023-41318
Description
matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround.
How to fix
- turt2live matrix-media-repo1.3.0 or later
- github.com/turt2live/matrix-media-repo1.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| turt2live matrix-media-repo | v < 1.3.0 | 1.3.0 |
| github.com/turt2live/matrix-media-repoGo | v < 1.3.0 | 1.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.