CVE-2026-56845

An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

Score

CVSS 3.0 7.5 High

Status

Deferred - support@hackerone.com

Published

2026-08-04

Last modified

2026-08-04

Weaknesses

CWE-22

Affected products

• Rocket.chat (Rocket.chat)

References

• https://hackerone.com/reports/3514640