CVE-2021-41281

CVE-2021-41281 is a path traversal vulnerability affecting Synapse Matrix homeservers prior to version 1.47.1, specifically when the media repository is enabled. An unauthenticated attacker can trick a vulnerable Synapse instance into downloading a file from a remote server into an arbitrary directory. While the attacker cannot fully control the final path, this still poses a significant risk. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a high severity due to its network-based attack vector and low attack complexity, requiring no user interaction or privileges. The primary impact is high integrity compromise (I:H), as arbitrary files can be written, though confidentiality and availability are not directly affected. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this CVE. This suggests it is not currently a widely targeted vulnerability.