Back to Database
Status published
Medium
CVE-2024-50336
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
Vulnerability Description
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-50336
Credits & Attribution
No credits recorded in the NVD database.
References
More from matrix-org
View All →CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
Low
1.3
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Low
2.7
CVE-2025-59047
matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
Low
2.7
CVE-2025-53549
Matrix Rust SDK allows SQL injection in the EventCache implementation
Medium
5.2
CVE-2025-48937
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
Medium
4.9
Affected Vendor
matrix-org
View all reports →Affected Software
matrix-js-sdk
Vulnerable Versions:
< 34.11.1
Timeline
Official Publish:
November 12th, 2024
Last Modified:
November 3rd, 2025
Added to House:
July 22nd, 2026