CVE-2024-51749

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-451

Affected software

VendorProductVersions
element-hqelement-web< 1.11.85

References

Timeline

Published
Nov 12, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-517505.0Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can CVE-2024-517516.5Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components areCVE-2024-517525.5The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. ICVE-2024-517532.1The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In afCVE-2024-517542.2Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is notCVE-2024-517552.2Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the sCVE-2024-517562.3The cap-std project is organized around the eponymous `cap-std` crate, and develops libraries to make it easy to write capability-based codeCVE-2024-517579.3happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may eCVE-2024-517582.3Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use CVE-2024-517597.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detlef Beyer SVT Simple svt-simple allCVE-2024-51769.4Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen CredentialCVE-2024-517607.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ristretto Apps Dashing Memberships das