Rocket.Chat’s sendFileMessage DDP method, when used by an authenticated user, forwards the entire attacker‑supplied file object to Uploads.updateFileComplete. The method merges the object into a MongoDB $set update using Object.assign without an allow‑list of writable fields. Consequently, an attacker can modify any field on their own upload record, notably the store and store‑specific path columns. This mass‑assignment flaw enables redirecting file metadata and exposing private files, leading to data theft. The issue is fixed in versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7 and 7.10.11, and is classified as CWE‑915.

Rocket.Chat versions earlier than 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11 are affected.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, so an exact exploitation probability cannot be quantified. Based on the description, it is inferred that the attacker must be an authenticated user to supply the file object, as the sendFileMessage method is described as accepting an authenticated file object. An authenticated attacker can use the mass assignment to modify metadata on the uploaded file, potentially causing data theft. Because the vulnerability is not listed in CISA’s KEV catalog, the risk remains significant until the fix is applied.