{"api_version":"1","generated_at":"2026-07-24T02:25:33+00:00","cve":"CVE-2021-41281","urls":{"html":"https://cve.report/CVE-2021-41281","api":"https://cve.report/api/cve/CVE-2021-41281.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-41281","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-41281"},"summary":{"title":"CVE-2021-41281","description":"Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2021-11-23 20:15:00","updated_at":"2023-11-07 03:38:00"},"problem_types":["CWE-22"],"metrics":[],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2/","name":"FEDORA-2021-2f9dcdbace","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 34 Update: matrix-synapse-1.48.0-1.fc34 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS/","name":"FEDORA-2021-9758549fce","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 35 Update: matrix-synapse-1.48.0-1.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/matrix-org/synapse/commit/91f2bd090","name":"https://github.com/matrix-org/synapse/commit/91f2bd090","refsource":"MISC","tags":[],"title":"Prevent the media store from writing outside of the configured directory · matrix-org/synapse@91f2bd0 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2/","name":"FEDORA-2021-2f9dcdbace","refsource":"","tags":[],"title":"[SECURITY] Fedora 34 Update: matrix-synapse-1.48.0-1.fc34 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/matrix-org/synapse/releases/tag/v1.47.1","name":"https://github.com/matrix-org/synapse/releases/tag/v1.47.1","refsource":"MISC","tags":[],"title":"Release v1.47.1 · matrix-org/synapse · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS/","name":"FEDORA-2021-9758549fce","refsource":"","tags":[],"title":"[SECURITY] Fedora 35 Update: matrix-synapse-1.48.0-1.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c","name":"https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c","refsource":"CONFIRM","tags":[],"title":"Path traversal when downloading remote media · Advisory · matrix-org/synapse · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41281","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41281","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"41281","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"34","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41281","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"35","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41281","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"matrix","cpe5":"synapse","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-41281","qid":"282099","title":"Fedora Security Update for matrix (FEDORA-2021-2f9dcdbace)"},{"cve":"CVE-2021-41281","qid":"282130","title":"Fedora Security Update for matrix (FEDORA-2021-9758549fce)"},{"cve":"CVE-2021-41281","qid":"502189","title":"Alpine Linux Security Update for synapse"},{"cve":"CVE-2021-41281","qid":"690482","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for py-matrix-synapse (27aa2253-4c72-11ec-b6b9-e86a64caca56)"},{"cve":"CVE-2021-41281","qid":"980024","title":"Python (pip) Security Update for matrix-synapse (GHSA-3hfw-x7gx-437c)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2021-41281","STATE":"PUBLIC","TITLE":"Path traversal in Matrix Synapse"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"synapse","version":{"version_data":[{"version_value":"< 1.47.1"}]}}]},"vendor_name":"matrix-org"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]},"references":{"reference_data":[{"name":"https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c","refsource":"CONFIRM","url":"https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c"},{"name":"https://github.com/matrix-org/synapse/commit/91f2bd090","refsource":"MISC","url":"https://github.com/matrix-org/synapse/commit/91f2bd090"},{"name":"https://github.com/matrix-org/synapse/releases/tag/v1.47.1","refsource":"MISC","url":"https://github.com/matrix-org/synapse/releases/tag/v1.47.1"},{"refsource":"FEDORA","name":"FEDORA-2021-2f9dcdbace","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2/"},{"refsource":"FEDORA","name":"FEDORA-2021-9758549fce","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS/"}]},"source":{"advisory":"GHSA-3hfw-x7gx-437c","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2021-11-23 20:15:00","lastModifiedDate":"2023-11-07 03:38:00","problem_types":["CWE-22"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"1.47.1","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"41281","Ordinal":"216868","Title":"CVE-2021-41281","CVE":"CVE-2021-41281","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"41281","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}