CVE-2026-56845 in Rocket.Chat

Summary

by MITRE • 08/04/2026

An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsible: Hackerone
• Reservation: 06/23/2026
• Disclosure: 08/04/2026
• Moderation: accepted
• Entry: VDB-385736
• CPE: ready
• CWE: CWE-22 (confirmed)
• CVSS: 5.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low
• Sector: Police, Pharma, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-56845
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56845
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-56845/