Description
An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rocket.Chat | Rocket.Chat | < 8.2.0, < 8.1.1, < 8.0.2, < 7.13.4, < 7.12.5, < 7.11.5, < 7.10.8 | 8.2.0 |