CVE-2024-51749

Name of the Vulnerable Software and Affected Versions Element Web and Desktop versions prior to 1.11.85

Description The issue concerns the handling of thumbnails for attachments, stickers, and images. Specifically, versions of Element Web and Desktop earlier than 1.11.85 do not check if these thumbnails are coherent. This oversight allows for the possibility of adding thumbnails to events that can trigger a file download once clicked.

Recommendations For versions prior to 1.11.85, update to version 1.11.85 or later to resolve the issue. As a temporary workaround, consider restricting the handling of thumbnails for attachments, stickers, and images until the update is applied.