When looking at the CVE itself, it seems like a bug that only gets triggered on a very specific corner case that neither the client or website alone can trigger.
Of course, it's good that it gets reported and fixed, but I'm pretty sure these kind of bugs can only get caught by people randomly stumbling on them
What's up with this website popping in my feed for the 6th time in less than a week ?
Edit : nevermind, after digging the website for a grand total of 5 seconds, it appears to be an advertising website for Ente (which has a paid plan besides being self hostable). That's shitty marketing from them if you ask me