matrix-js-sdk versions before 34.11.1 contain a client-side path traversal vulnerability via crafted MXC URIs. This flaw allows a malicious room member to cause clients using the SDK to send arbitrary authenticated GET requests to the client's homeserver. The vulnerability arises because the SDK does not validate the server-name and media-id components of MXC URIs on the client side, contrary to the Matrix specification's security considerations. The issue is fixed in version 34.11.1.