What is the CVSS score of CVE-2026-56845?

CVE-2026-56845 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Rocket.Chat are affected by CVE-2026-56845?

Rocket.Chat self-hosted deployments with FileSystem-based custom sounds are vulnerable to unauthenticated remote arbitrary file read (CVE-2026-56845).. A patch is available.

How to fix or mitigate CVE-2026-56845?

Within 24 hours: audit all Rocket.Chat instances to identify systems with the CustomSounds feature enabled and FileSystem storage configured; disable the feature immediately or switch storage backend to database or cloud object storage as temporary mitigation. Within 7 days: deploy network-level controls restricting the /custom-sounds/ endpoint access via reverse proxy, WAF, or firewall rules; enable comprehensive logging on file access patterns for threat detection. Within 30 days: monitor Rocket.Chat security advisories for vendor patch release; evaluate and test any available patch in staging; plan and execute upgrade to patched version; conduct credentials audit to identify and rotate any secrets potentially exposed.

Rocket.Chat CVE-2026-56845

EUVD-2026-52560 HIGH

Path Traversal (CWE-22)

2026-08-04 hackerone

GHSA-6c37-9jgq-mgm8

Path Traversal Rocket Chat

7.5

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable, no auth required per description and CVSS PR:N; AC:L reflects that the FileSystem storage condition is a deployment choice, not an attack-time complexity barrier; C:H for arbitrary file read, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 04, 2026 - 02:16 EUVD

Analysis Generated

Aug 04, 2026 - 01:12 vuln.today

CVE Published

Aug 04, 2026 - 00:43 cve.org

HIGH 7.5

DescriptionCVE.org

An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

AnalysisAI

Unauthenticated path traversal in Rocket.Chat's /custom-sounds/ endpoint allows any remote attacker to read arbitrary files from the server filesystem when the CustomSounds feature is configured to use FileSystem storage. By injecting ../ sequences into the request path, an attacker can exfiltrate sensitive server files such as configuration files, private keys, or credential stores outside the intended sound file directory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network vector and high confidentiality impact (CVSS 7.5) make this a serious risk for self-hosted deployments with FileSystem storage enabled.

Technical ContextAI

Rocket.Chat (cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*) is a widely-used open-source self-hosted team communication platform. The affected endpoint /custom-sounds/ serves user-uploaded audio files and resolves file paths directly on the server's local filesystem when the CustomSounds storage backend is set to FileSystem rather than an object/cloud storage provider (e.g., S3). CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) arises because user-supplied path components in HTTP requests are not sanitized before being joined to the base directory, allowing traversal sequences such as ../../../../etc/passwd to escape the intended sound file root. The CPE wildcard (*) across all version fields indicates no specific version range has been bounded in available data - all Rocket.Chat versions are potentially in scope. This class of vulnerability is well-understood and trivially exploitable once the precondition (FileSystem storage) is met.

RemediationAI

No vendor-released patch has been identified at time of analysis. Monitor the HackerOne report at https://hackerone.com/reports/3514640 and the Rocket.Chat security advisories channel for a confirmed fix version and apply it as soon as available. As an immediate compensating control, switch the CustomSounds storage backend from FileSystem to an S3-compatible or cloud object storage provider - this eliminates local filesystem path resolution entirely and fully mitigates the vulnerability without functional impact to end users. If FileSystem storage cannot be changed immediately, restrict access to the /custom-sounds/ endpoint at the reverse proxy or WAF layer to trusted IP ranges only; note this will break custom sound delivery for external or remote users. Additionally, ensure the Rocket.Chat server process runs under a dedicated least-privilege OS user with read access scoped only to its required directories, minimizing the files reachable via traversal even if the endpoint is exploited.