Read the docs
TI-2023-21918 Aliases CVE-2023-41318GHSA-5crw-6j7v-xc72

Unsafe media served inline on download endpoints in matrix-media-repo

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00516 44th percentileScored 2026-11-07
Fix Fixed matrix-media-repo (turt2live): 1.3.0github.com/turt2live/matrix-media-repo (Go): 1.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
turt2livematrix-media-repobefore 1.3.01.3.0Patch availableCNA
—github.com/turt2live/matrix-media-repo (Go)before 1.3.01.3.0Patch availableGHSA-5crw-6j7v-xc72
  • matrix-media-repo Vendorturt2live Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
  • github.com/turt2live/matrix-media-repo (Go) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-5crw-6j7v-xc72

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:turt2live:matrix-media-repo:*:*:*:*:*:*:*:*before 1.3.0Vulnerableturt2live
  • cpe:2.3:a:turt2live:matrix-media-repo:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·turt2live

Remediation

  • Fix · CNA matrix-media-repo (turt2live) Fixed in 1.3.0
  • Fix · GHSA-5crw-6j7v-xc72 github.com/turt2live/matrix-media-repo (Go) Fixed in 1.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-41318
  2. 2026-10-03 Alias added: GHSA-5crw-6j7v-xc72

References

Patch 2

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences