CVE-2023-41318

matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround.

• CWE-79
• CWE-79

• https://developer.mozilla.org/en-US/docs/Web/SVG/Element/scriptThird Party Advisory
• https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137Patch
• https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59Patch
• https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-5crw-6j7v-xc72Vendor Advisory
• https://developer.mozilla.org/en-US/docs/Web/SVG/Element/scriptThird Party Advisory
• https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137Patch
• https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59Patch
• https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-5crw-6j7v-xc72Vendor Advisory

Published

Sep 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41311Permission control vulnerability in the audio module. Succes…5.3
• CVE-2023-41312Permission control vulnerability in the audio module. Succes…5.3
• CVE-2023-41313The authentication method in Apache Doris versions before 2.…9.8
• CVE-2023-41314The api /api/snapshot and /api/get_log_file would allow unau…8.2
• CVE-2023-41316Tolgee is an open-source localization platform. Due to lack …5.4
• CVE-2023-41317The Apollo Router is a configurable, high-performance graph …5.9
• CVE-2023-41319Fides is an open-source privacy engineering platform for man…7.2
• CVE-2023-4132A use-after-free vulnerability was found in the siano smsusb…5.5
• CVE-2023-41320GLPI stands for Gestionnaire Libre de Parc Informatique is a…9.8
• CVE-2023-41321GLPI stands for Gestionnaire Libre de Parc Informatique is a…6.5
• CVE-2023-41322GLPI stands for Gestionnaire Libre de Parc Informatique is a…8.8
• CVE-2023-41323GLPI stands for Gestionnaire Libre de Parc Informatique is a…5.3