CVE-2026-56845 - Vulnerability Details - OpenCVE

An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Rocket.chat	Rocket.chat

No data.

No data.

References

Link	Providers
https://hackerone.com/reports/3514640

History

Tue, 04 Aug 2026 21:00:00 +0000

Type	Values Removed	Values Added
Title		Unauthenticated local file inclusion via Rocket.Chat /custom-sounds/ directory traversal

Tue, 04 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 04 Aug 2026 03:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rocket.chat Rocket.chat rocket.chat
Vendors & Products		Rocket.chat Rocket.chat rocket.chat

Tue, 04 Aug 2026 01:00:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.
Weaknesses		CWE-22
References		https://hackerone.com/reports/3514640
Metrics		cvssV3_0 `{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2026-08-04T00:43:48.076Z

Updated: 2026-08-04T15:04:12.768Z

Reserved: 2026-06-23T15:00:03.632Z

Link: CVE-2026-56845

Vulnrichment

Updated: 2026-08-04T14:28:28.550Z

NVD

Status : Received

Published: 2026-08-04T01:16:19.660

Modified: 2026-08-04T16:16:25.600

Link: CVE-2026-56845

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56845", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-06-23T15:00:03.632Z", "datePublished": "2026-08-04T00:43:48.076Z", "dateUpdated": "2026-08-04T15:04:12.768Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Rocket.Chat", "product": "Rocket.Chat", "versions": [{"version": "0", "status": "affected", "lessThan": "8.2.0", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "8.1.1", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "8.0.2", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "7.13.4", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "7.12.5", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "7.11.5", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "7.10.8", "versionType": "semver"}]}], "references": [{"url": "https://hackerone.com/reports/3514640"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-22", "description": "CWE-22 Path Traversal"}]}], "credits": [{"lang": "en", "value": "s (howtoplay)", "type": "finder"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-08-04T00:43:48.076Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T14:28:27.555647Z", "id": "CVE-2026-56845", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T15:04:12.768Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-56845", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T14:28:27.555647Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T14:28:28.550Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "s (howtoplay)"}], "metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "Rocket.Chat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": "0", "lessThan": "8.2.0", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "8.1.1", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "8.0.2", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "7.13.4", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "7.12.5", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "7.11.5", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "7.10.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://hackerone.com/reports/3514640"}], "descriptions": [{"lang": "en", "value": "An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Path Traversal"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-08-04T00:43:48.076Z"}}}, "cveMetadata": {"cveId": "CVE-2026-56845", "state": "PUBLISHED", "dateUpdated": "2026-08-04T15:04:12.768Z", "dateReserved": "2026-06-23T15:00:03.632Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-08-04T00:43:48.076Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}