{"id":"CVE-2024-53863","aliases":["GHSA-vp6v-whfm-rv3g","PYSEC-2026-1615"],"title":"Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders","summary":"Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders","severity":"high","vendor":"matrix-synapse","product":"matrix-synapse","ecosystem":"pip","affected":["matrix-synapse < 1.120.1"],"patched":["matrix-synapse 1.120.1"],"published":"2024-12-03","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vp6v-whfm-rv3g","references":[{"url":"https://github.com/element-hq/synapse/security/advisories/GHSA-vp6v-whfm-rv3g"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53863"},{"url":"https://github.com/element-hq/synapse"}],"tags":["osv","pip"],"epss":0.00606,"epssPercentile":0.47681,"ingestedAt":"2026-07-08T18:25:53.351Z","slug":"CVE-2024-53863","body":"## Overview\n\n### Impact\n\nIn Synapse versions before 1.120.1, enabling the `dynamic_thumbnails` option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing.\n\nThis significantly expands the attack surface in a historically vulnerable area, presenting a risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or within the Matrix ecosystem.\n\nFor a list of image formats, as well as decoding libraries and helper programs used, see [the Pillow documentation](https://pillow.readthedocs.io/en/stable/handbook/image-file-formats.html).\n\n### Patches\n\nSynapse 1.120.1 addresses the issue by restricting thumbnail generation to images in the following widely used formats: PNG, JPEG, GIF, and WebP.\n\n### Workarounds\n\n- Ensure any image codecs and helper programs, such as Ghostscript, are patched against security vulnerabilities.\n- Uninstall unused image decoder libraries and helper programs, such as Ghostscript, from the system environment that Synapse is running in.\n    - Depending on the installation method, there may be some decoder libraries bundled with Pillow and these cannot be easily uninstalled.\n    - The official Docker container image does not include Ghostscript.\n\n### References\n\n- [The Pillow documentation](https://pillow.readthedocs.io/en/stable/handbook/image-file-formats.html) includes a list of supported image formats and which libraries or helper programs are used to decode them.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).\n\n\n## Affected packages\n\n- `matrix-synapse < 1.120.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-synapse 1.120.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}