buildForwardContent copies the source event's content verbatim (minus relations and mentions), including the file block with key.k, iv and hashes. Forwarding an attachment from an E2EE room into an unencrypted room therefore publishes the decryption key for that media in cleartext, letting anyone who can read the destination room (and the homeserver) decrypt the original encrypted attachment. Element re-uploads media on forward for exactly this reason.
How to trigger
Forward an image from an encrypted room to an unencrypted one and inspect the resulting event.
Suggested fix
When the source has content.file and the destination room is not encrypted, re-download + re-upload the media (or refuse the forward with an explanation); marked medium confidence because the operational risk depends on how mixed-encryption the deployment is.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** low · **Type:** security · **Confidence:** medium
**Location:** `src/app/features/room/message/forwardContent.ts:16-41`, `src/app/features/room/message/ForwardMessageDialog.tsx:322`
### Problem
`buildForwardContent` copies the source event's content verbatim (minus relations and mentions), including the `file` block with `key.k`, `iv` and `hashes`. Forwarding an attachment from an E2EE room into an **unencrypted** room therefore publishes the decryption key for that media in cleartext, letting anyone who can read the destination room (and the homeserver) decrypt the original encrypted attachment. Element re-uploads media on forward for exactly this reason.
### How to trigger
Forward an image from an encrypted room to an unencrypted one and inspect the resulting event.
### Suggested fix
When the source has `content.file` and the destination room is not encrypted, re-download + re-upload the media (or refuse the forward with an explanation); marked medium confidence because the operational risk depends on how mixed-encryption the deployment is.
---
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:21 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: security · Confidence: medium
Location:
src/app/features/room/message/forwardContent.ts:16-41,src/app/features/room/message/ForwardMessageDialog.tsx:322Problem
buildForwardContentcopies the source event's content verbatim (minus relations and mentions), including thefileblock withkey.k,ivandhashes. Forwarding an attachment from an E2EE room into an unencrypted room therefore publishes the decryption key for that media in cleartext, letting anyone who can read the destination room (and the homeserver) decrypt the original encrypted attachment. Element re-uploads media on forward for exactly this reason.How to trigger
Forward an image from an encrypted room to an unencrypted one and inspect the resulting event.
Suggested fix
When the source has
content.fileand the destination room is not encrypted, re-download + re-upload the media (or refuse the forward with an explanation); marked medium confidence because the operational risk depends on how mixed-encryption the deployment is.Filed from the September 2026 client audit (branch
lotus@4bea4895).