Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Synapse Media Download Security Risk for Some Homeservers

CVE-2021-41281 · published 4 years ago
Summary

A security issue affects Synapse homeservers with media repositories enabled. If not patched, an attacker could trick the server into downloading a file from a remote location without permission. To fix this, update to version 1.47.1 or later, or consider disabling the media repository or using a workaround like blocking certain endpoints or using a hardened configuration.

What to do
  • Update matrix.org team and contributors matrix-synapse to version 1.47.1.
  • Update debian matrix-synapse to version 1.47.1-1.
  • Update matrix synapse to version 1.47.1 or later.
Affected software
Ecosystem VendorProductAffected versions
pip matrix.org team and contributors matrix-synapse < 1.47.1
Fix: upgrade to 1.47.1
– matrix synapse < 1.47.1
cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*
– fedoraproject fedora 34
35
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Debian:14 debian matrix-synapse < 1.47.1-1
Fix: upgrade to 1.47.1-1
Original advisory text
Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a r...
Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.7 High
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published23 Nov 2021
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-3hfw-x7gx-437c · GHSA
CVE-2021-41281 · NVD
DEBIAN-CVE-2021-41281 · OSV
Track software like this
Free during beta