CVE-2024-50336 — Path Traversal in Matrix-js-sdk

Vendor	Product	Version range	Fixed in
debian	node-matrix-js-sdk	< thunderbird 1:128.6.0esr-1~deb12u1 (bookworm)	thunderbird 1:128.6.0esr-1~deb12u1 (bookworm)
debian	thunderbird	< thunderbird 1:128.6.0esr-1~deb12u1 (bookworm)	thunderbird 1:128.6.0esr-1~deb12u1 (bookworm)
matrix-org	matrix-js-sdk	< 34.11.1	34.11.1
matrix-org	matrix-js-sdk	>= 0 < 34.11.1	34.11.1
mozilla	firefox	—	—
mozilla	thunderbird	>= 0 < 1:128.6.0esr-1~deb11u1	1:128.6.0esr-1~deb11u1
mozilla	thunderbird	>= 0 < 1:128.6.0esr-1~deb12u1	1:128.6.0esr-1~deb12u1
mozilla	thunderbird	>= 0 < 1:128.5.2esr-1	1:128.5.2esr-1
mozilla	thunderbird	>= 0 < 1:128.5.2esr-1	1:128.5.2esr-1

OSV

CVE-2024-50336: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript

osv·2024-11-12·CVSS 5.3

CVE-2024-50336 [MEDIUM] CVE-2024-50336: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.

GHSA

matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

ghsa·2024-11-12

CVE-2024-50336 [MEDIUM] CWE-22 matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal ### Summary matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. ### Details The Matrix specification demands homeservers to [perform validation](https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5) of the `server-name` and `media-id` components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a similar check must also be performed on the client to prevent *client-side* path traversal. matrix-js-sdk fails to perform this validation. ### Patches Fixed

OSV

matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

osv·2024-11-12

CVE-2024-50336 [MEDIUM] matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal ### Summary matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. ### Details The Matrix specification demands homeservers to [perform validation](https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5) of the `server-name` and `media-id` components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a similar check must also be performed on the client to prevent *client-side* path traversal. matrix-js-sdk fails to perform this validation. ### Patches Fixed

Ubuntu

Thunderbird vulnerabilities

vendor_ubuntu·2026-02-02

CVE-2025-8031 Thunderbird vulnerabilities Title: Thunderbird vulnerabilities Summary: Several security issues were fixed in Thunderbird. Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. Instructions: In general, a standard system update will make all the necessary changes.

Debian

CVE-2024-50336: node-matrix-js-sdk - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. m...

vendor_debian·2024·CVSS 5.3

CVE-2024-50336 [MEDIUM] CVE-2024-50336: node-matrix-js-sdk - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. m... matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1. Scope: local bullseye: open

Mozilla

Mozilla Foundation Security Advisory 2024-69: CVE-2024-50336

vendor_mozilla·CVSS 5.3

CVE-2024-50336 [MEDIUM] Mozilla Foundation Security Advisory 2024-69: CVE-2024-50336 Mozilla Foundation Security Advisory 2024-69 CVE: CVE-2024-50336 Product: Thunderbird Impact: moderate Fixed in: Thunderbird 128.5.2

Mozilla

Mozilla Foundation Security Advisory 2025-04: CVE-2024-50336

vendor_mozilla·CVSS 5.3

CVE-2024-50336 [MEDIUM] Mozilla Foundation Security Advisory 2025-04: CVE-2024-50336 Mozilla Foundation Security Advisory 2025-04 CVE: CVE-2024-50336 Product: Thunderbird Impact: high Fixed in: Thunderbird 134

CVE-2024-50336: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via…

Affected

CVSS provenance