We have just published a security release of Synapse (1.61.1), which fixes a vulnerability with URL previews. Administrators of Synapse instances are encouraged to update ASAP!
For more information and workarounds, see the announcement on our blog.
https://matrix.org/blog/2022/06/28/security-release-synapse-1-61-1