An unauthenticated path traversal vulnerability exists within Rocket.Chat’s /custom-sounds/ endpoint when CustomSounds storage is configured to FileSystem. By inserting "../" sequences into the request path, an attacker can read any file outside the designated base directory. This flaw allows the disclosure of arbitrary files, potentially including configuration data, credentials, or other sensitive system files, directly to an unauthenticated user, thereby compromising confidentiality of the system.

The flaw is present in the Rocket.Chat product whenever CustomSounds storage is set to FileSystem. No specific version information is disclosed in the advisory, so all versions that enable this storage mode may be vulnerable unless reviewed and patched by the vendor.

The CVSS score of 7.5 indicates a medium‑to‑high severity vulnerability. The EPSS score is not available, but the flaw is exploitable via unauthenticated requests, meaning any user can trigger the attack without needing credentials. While it is not listed in the CISA KEV catalog, the absence does not mitigate the risk. An attacker can read arbitrary files, which may include secrets or system configuration, leading to a significant confidentiality breach. Effective exploitation requires the CustomSounds storage be configured to FileSystem and the attacker to target the vulnerable endpoint.