PT-2025-38059 · Unknown · Element Web+1

Davidegirardi · Published 2025-09-16 · Updated 2025-09-17 · CVE-2025-59161

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Element Web versions prior to 1.11.112 Element Desktop versions prior to 1.11.112

Description Element Web and Element Desktop are susceptible to a room list manipulation issue due to insufficient validation of room predecessor links. A remote attacker may attempt to temporarily replace a room's entry in the room list with a room controlled by the attacker, potentially misleading users. Reloading or refreshing the page will restore the correct room list.

Recommendations Upgrade Element Web to version 1.11.112. Upgrade Element Desktop to version 1.11.112.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-59161

GHSA-M6C8-98F4-75RR

OPENSUSE-SU-2025:15558-1

OPENSUSE-SU-2025:15559-1

Affected Products

Element Desktop

Element Web

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59161.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59161 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15558-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59161 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15559-1 · Vendor Advisory
• https://github.com/element-hq/element-web/security/advisories/GHSA-m6c8-98f4-75rr · Note
• https://github.com/element-hq/element-web/commit/8e9a43d70c90e6a3b110cd0a377296079e4c81f5 · Note
• https://suse.com/security/cve/CVE-2025-59161 · Note
• https://t.me/CVEtracker/32667 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1968137235615584696 · Twitter Post
• https://twitter.com/CVEnew/status/1968190786157035756 · Twitter Post