CVE-2026-45687: Rocket.Chat File Upload Field Injection (CVSS 8.5)

Technical summary

The vulnerability exists in Rocket.Chat's sendFileMessage DDP (Distributed Data Protocol) method, which accepts a file object from the client and passes it directly into the Uploads.updateFileComplete function. This function uses Object.assign to merge the attacker-controlled file object into a MongoDB $set update operation without an allow-list of writable fields. An authenticated attacker can therefore inject arbitrary fields into their upload record, including the 'store' field and store-specific path fields. This represents a classic insecure direct object property assignment vulnerability (CWE-915), where client-supplied data bypasses intended access controls.

Business impact

Organizations running vulnerable Rocket.Chat instances face risks to data confidentiality and integrity. An attacker with valid credentials could potentially redirect file storage references, access files stored in alternative storage backends, or corrupt file metadata in ways that impact availability or enable lateral movement within the communications infrastructure. For enterprises using Rocket.Chat as a secure communications backbone, this vulnerability could undermine trust in file handling practices and create compliance concerns if file integrity or provenance becomes questioned.

Affected systems

Rocket.Chat versions 8.4.0 and earlier, 8.3.2 and earlier, 8.2.2 and earlier, 8.1.3 and earlier, 8.0.4 and earlier, 7.13.6 and earlier, and 7.10.10 and earlier are vulnerable. Fixed versions are 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11. Organizations should identify all Rocket.Chat deployments and determine their current version against this patched list.

Exploitability

The vulnerability requires an authenticated user account, which moderately raises the exploitation bar. However, once authenticated, no special privileges, multi-step social engineering, or race conditions are needed—an attacker simply sends a modified file object in the DDP message. The network barrier is low (network accessible), and exploitation logic is straightforward, making this a high-exploitability issue for organizations where internal users cannot be fully trusted or where account compromise is a realistic threat model.

Remediation

Immediately upgrade all Rocket.Chat instances to one of the patched versions: 8.5.0 or later for the 8.x line, or 7.13.7 and 7.10.11 for the 7.x line. Patch selection should align with your current version and support policy. After upgrading, verify that file upload and retrieval workflows continue to function as expected, and consider auditing file metadata in MongoDB to detect any unauthorized modifications from the window of vulnerability.

Patch guidance

Deploy patches to production Rocket.Chat instances as soon as feasible, prioritizing internet-facing or multi-tenant deployments where account compromise risk is highest. Test patches in a staging environment to confirm compatibility with your customizations, Rocket.Chat plugins, and storage backend configurations (S3, filesystem, etc.). Stagger deployment across instances if necessary to minimize service disruption, but avoid leaving systems unpatched for extended periods. Consult Rocket.Chat's official release notes for your target version to verify any compatibility changes or data migration steps.

Detection guidance

Review MongoDB query logs or audit trails for suspicious $set operations on the 'uploads' collection that modify the 'store' or storage path fields. Monitor DDP message traffic for sendFileMessage calls with file objects containing unexpected fields like 'store', 'path', 's3.bucket', or filesystem-specific metadata. Implement alerts on file upload events where the client-supplied file metadata differs significantly from what the application should have accepted. Consider sampling server logs for any file access anomalies following uploads.

Why prioritize this

This vulnerability scores CVSS 8.5 (HIGH) due to network accessibility, low attack complexity, and high confidentiality impact, despite requiring prior authentication. It is not currently listed on the CISA KEV catalog, but the straightforward attack mechanics and potential for data exfiltration or manipulation warrant rapid patching. Organizations should prioritize this above lower-severity vulnerabilities and rank it below only critical flaws affecting unauthenticated or pre-auth code execution.

Risk score, explained

The CVSS 8.5 score reflects a network-accessible attack requiring only user-level privileges (PR:L), with no user interaction, and consequences affecting confidentiality (C:H) and integrity (I:L) across system boundaries (S:C). The score appropriately penalizes the authentication requirement but credits the ease of exploitation and broad impact on file data. In environments where internal threats are a concern or where Rocket.Chat is used for sensitive communications, the business risk may exceed the numerical score.

Frequently asked questions