https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 00:10:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-188581 EUVD-2026-188581 https://cve.radiocsirt.org/vuln/euvd-2026-188581 https://cve.radiocsirt.org/vuln/fkie_cve-2023-41318 <p>matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround.</p> <p>matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-41318 https://cve.radiocsirt.org/vuln/ghsa-5crw-6j7v-xc72 <p><strong>Affected:</strong> Go: github.com/turt2live/matrix-media-repo</p> <p>### Impact A malicious user can upload an SVG image containing JavaScript to their server. When matrix-media-repo is asked to serve that media via the `/_matrix/media/(r0|v3)/download` endpoint, it would be served with a `Content-Disposition` of `inline`. This can allow JavaScript to run in the browser if a client links to the `/download` endpoint directly.</p> <p>Server operators which do not share a domain between matrix-media-repo and other services are not affected, but are encouraged to upgrade regardless.</p> <p>### Patches https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137 and https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59 fix the issue. Operators should upgrade to v1.3.0 as soon as possible.</p> <p>### Workarounds The `Content-Disposition` header can be overridden by the reverse proxy in front of matrix-media-repo to always use `attachment`, defeating this issue at the cost of &#34;worse&#34; user experience when clicking download links.</p> <p>### References https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script</p> <p><strong>Affected:</strong> Go: github.com/turt2live/matrix-media-repo</p> <p>### Impact A malicious user can upload an SVG image containing JavaScript to their server. When matrix-media-repo is asked to serve that media via the `/_matrix/media/(r0|v3)/download` endpoint, it would be served with a `Content-Disposition` of `inline`. This can allow JavaScript to run in the browser if a client links to the `/download` endpoint directly.</p> <p>Server operators which do not share a domain between matrix-media-repo and other services are not affected, but are encouraged to upgrade regardless.</p> <p>### Patches https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137 and https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59 fix the issue. Operators should upgrade to v1.3.0 as soon as possible.</p> <p>### Workarounds The `Content-Disposition` header can be overridden by the reverse proxy in front of matrix-media-repo to always use `attachment`, defeating this issue at the cost of &#34;worse&#34; user experience when clicking download links.</p> <p>### References https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script</p> https://cve.radiocsirt.org/vuln/ghsa-5crw-6j7v-xc72 https://cve.radiocsirt.org/vuln/gsd-2023-41318 gsd-2023-41318 https://cve.radiocsirt.org/vuln/gsd-2023-41318