TI-2021-18113 Aliases CVE-2021-41281 GHSA-3hfw-x7gx-437c

Path traversal in Matrix Synapse

LOW 36CWE-22Published 2021-11-23 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.

Why it matters now

EPSS 0.01577 75th percentileScored 2026-11-07

Fix Fixed synapse (matrix-org): 1.47.1matrix-synapse (PyPI): 1.47.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
matrix-org	synapse	before 1.47.1	1.47.1	Patch available	CNA
—	matrix-synapse (PyPI)	before 1.47.1	1.47.1	Patch available	GHSA-3hfw-x7gx-437c

synapse Vendormatrix-org Affected before 1.47.1 Fixed in 1.47.1 Patch available CNA
matrix-synapse (PyPI) Vendor— Affected before 1.47.1 Fixed in 1.47.1 Patch available GHSA-3hfw-x7gx-437c

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:matrix:synapse::::::::	before 1.47.1	Vulnerable	matrix-org
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:::::::*	35	Vulnerable	Fedoraproject

cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* Versions before 1.47.1 Vulnerable ·matrix-org
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

Fix · CNA synapse (matrix-org) Fixed in 1.47.1
Fix · GHSA-3hfw-x7gx-437c matrix-synapse (PyPI) Fixed in 1.47.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2021-41281
2026-10-03 Alias added: GHSA-3hfw-x7gx-437c

References

Patch 1

https://github.com/matrix-org/synapse/commit/91f2bd090

Advisory 5

Other 4

TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
TI-2024-35327 Synapse allows a a malformed invite to break the invitee's `/sync` CVSS 4.0HIGH 8.7
TI-2019-13571 Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. CVSS 3.1CRITICAL 9.8
TI-2024-36056 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVSS 4.0HIGH 8.2
TI-2024-35318 Synapse allows unsupported content types to lead to memory exhaustion CVSS 4.0HIGH 8.2
TI-2018-11846 Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have… CVSS 3.0HIGH 8.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences