CVE-2025-59161: element-hq element-web Improper Input Validation

Vulnerability summary

CVE-2025-59161 is a low (CVSS 2.7) Improper Input Validation vulnerability in element-hq element-web. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.6% of scored vulnerabilities.

Timeline

1. 16-09-2025
   PublishedVulnerability first disclosed.
2. 16-09-2025
   Last modifiedVulnerability information updated.

Description

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect of this is temporary, it may still confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112. A reload/refresh will fix the incorrect room list state, removing the attacker's room and restoring the original room.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.