CVE-2024-51749 - CVE House
Back to Database
Status published Low CVE-2024-51749

Element's thumbnails can be abused to misrepresent the content of an attachment

Vulnerability Description

Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51749

Credits & Attribution

No credits recorded in the NVD database.

References

More from element-hq

View All →
CVE-2025-62425
Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password
High 8.3
CVE-2025-61672
Synapse: Invalid device keys degrade federation functionality
Medium 5.3
CVE-2025-59161
In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left
Low 2.7
CVE-2025-32026
Element Web could load a malicious instance of Element Call leaking media encryption keys
Low 3.8
CVE-2025-31127
Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call
Medium 5.3

Affected Vendor

Affected Software

element-web
Vulnerable Versions:
< 1.11.85

Timeline

Official Publish: November 12th, 2024
Last Modified: November 12th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-451

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.