← CVE Intelligence

CVE-2026-56845

Rocket.Chat / Rocket.Chat PUBLISHED

Description (CNA)

An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

Affected (CNA)

Vendor / productVersions
Rocket.Chat / Rocket.Chataffected 0 before 8.2.0; affected 0 before 8.1.1; affected 0 before 8.0.2; affected 0 before 7.13.4; affected 0 before 7.12.5; affected 0 before 7.11.5; affected 0 before 7.10.8

CWE

CWE-22

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.