CVE-2026-56845

Description

An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

Overview

State: PUBLISHED
Assigner (CNA): hackerone
CVSS severity: HIGH
CVSS score: 7.5 / 10
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Effective score: 7.5 / 10 HIGH source: CNA overview
CWE(s): CWE-22
Reserved: 2026-06-23
Published: 2026-08-04 00:43 UTC
Last updated: 2026-08-04 00:43 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/56xxx/CVE-2026-56845.json
Linked Threat: CVE-2026-56845 — CVE-2026-56845

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-08-04 01:16:19 UTC
NVD last modified: 2026-08-04 01:16:19 UTC
EPSS score: 0.0036 (probability of exploitation in next 30 days)
EPSS percentile: 28.66% vs all CVEs — higher = more likely to be exploited, as of 2026-08-04

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-52560
Assigner: hackerone
Published: Aug 4, 2026, 12:43:48 AM
Updated: Aug 4, 2026, 3:04:12 PM
EUVD base score (CVSS 3.0): 7.5 / 10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EUVD-reported EPSS: 0.0000
Vendors: Rocket.Chat
Products: Rocket.Chat (0 <7.10.8)

Rocket.Chat (0 <7.11.5)

Rocket.Chat (0 <8.0.2)

Rocket.Chat (0 <7.12.5)

Rocket.Chat (0 <8.2.0)

Rocket.Chat (0 <7.13.4)

Rocket.Chat (0 <8.1.1)
Aliases: GHSA-6c37-9jgq-mgm8

ENISA description: An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

EUVD references (1)

https://hackerone.com/reports/3514640

Affected products (1)

Vendor	Product	Versions	Platforms
Rocket.Chat	Rocket.Chat	`0` (affected), `0` (affected), `0` (affected), `0` (affected), `0` (affected), `0` (affected), `0` (affected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://hackerone.com/reports/3514640

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://hackerone.com/reports/3514640

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://hackerone.com/reports/3514640 support@hackerone.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CISA Warns Actively Exploited Microsoft SharePoint RCE Flaw Requires ...

web:cyberpress.org

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft SharePoint Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild and setting an aggressive remediation deadline for federal agencies and organizations running the platform.

2026-08-04 16:52 UTC
NVD - Home

web:nvd.nist.gov

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

2026-08-04 16:52 UTC
CVE-2026-56845: Path Traversal (High 7.5) | O3 Security

web:o3.security

Remediation status No patched version of the affected component has shipped for CVE-2026-56845 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation .

2026-08-04 16:52 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-08-04 16:52 UTC
Addressing Exchange Server May 2026 vulnerability CVE-2026-42897 ...

web:techcommunity.microsoft.com

Hi team, Our organization has successfully implemented the recommended mitigation for CVE - 2026 -42897. However, we are currently experiencing the documented known issues within our environment. Could the Exchange team kindly provide a tentative timeline or ETA for a permanent security update that resolves the underlying vulnerability while addressing these known issues? We would greatly ...

2026-08-04 16:52 UTC
National Vulnerability Database | NIST

web:www.nist.gov

NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.

2026-08-04 16:52 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-08-04 16:52 UTC
Oracle Critical Security Patch Update Advisory - May 2026

web:www.oracle.com

This Critical Security Patch Update contains 35 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Security Patch Update and other Oracle Software Security Assurance activities is located at May 2026 Critical Security Patch Update: Executive Summary and Analysis.

2026-08-04 16:52 UTC
Resecurity | From Web Request to Domain Compromise: Understanding the ...

web:www.resecurity.com

The July 2026 SharePoint security update addresses six significant vulnerabilities affecting on-premises Microsoft SharePoint Server deployments. Three vulnerabilities—CVE- 2026 -32201, CVE - 2026 -45659, and CVE - 2026 -56164—have been confirmed by CISA as actively exploited and added to the Known Exploited Vulnerabilities (KEV) Catalog, requiring immediate remediation . Three additional ...

2026-08-04 16:52 UTC
July 2026 Patch Tuesday: Largest Patch Tuesday 569 CVEs - Tenable

web:www.tenable.com

Microsoft patched 569 CVEs in July 2026 , the largest Patch Tuesday release in its history. 56 critical CVEs patched including three zero-day vulnerabilities.

2026-08-04 16:52 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-56845.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Rocket.Chat",
          "vendor": "Rocket.Chat",
          "versions": [
            {
              "lessThan": "8.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.13.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.12.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.11.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.10.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "s (howtoplay)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T00:43:48.076Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3514640"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-56845",
    "datePublished": "2026-08-04T00:43:48.076Z",
    "dateReserved": "2026-06-23T15:00:03.632Z",
    "dateUpdated": "2026-08-04T00:43:48.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}