CVE-2021-41281

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.

• CWE-22
• CWE-22

• https://github.com/matrix-org/synapse/commit/91f2bd090Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.47.1Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437cMitigation, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2/
• https://github.com/matrix-org/synapse/commit/91f2bd090Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.47.1Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437cMitigation, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2/

Published

Nov 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41276Tuleap is a Libre and Open Source tool for end to end tracea…7.2
• CVE-2021-41277Metabase is an open source data analytics platform. In affec…7.5
• CVE-2021-41278Functions SDK for EdgeX is meant to provide all the plumbing…5.7
• CVE-2021-41279BaserCMS is an open source content management system with a …8.8
• CVE-2021-4128When transitioning in and out of fullscreen mode, a graphics…6.5
• CVE-2021-41280Sharetribe Go is a source available marketplace software. In…9.8
• CVE-2021-41282diag_routes.php in pfSense 2.5.2 allows sed data injection. …8.8
• CVE-2021-41285Ballistix MOD Utility through 2.0.2.5 is vulnerable to privi…7.8
• CVE-2021-41286Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-si…7.8
• CVE-2021-41288Zoho ManageEngine OpManager version 125466 and below is vuln…9.8
• CVE-2021-41289ASUS P453UJ contains the Improper Restriction of Operations …6.3
• CVE-2021-4129Mozilla developers and community members Julian Hector, Rand…9.8