PT-2025-29132
CVE-2025-53549
·
Published
2025-07-10
·
Updated
2025-07-17
Description by
CVSS 4.0
5.2
MediumMetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions:
matrix-sdk versions 0.11 through 0.12
Description:
An SQL injection vulnerability exists in the
EventCache::find event with relations method. This allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner.Recommendations:
Pass only trusted or sanitised relation types to the
filter argument of the EventCache::find event with relations() method.
Update to version 0.13.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾