CVE-2026-45687

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.5.0 Rocket.Chat versions prior to 8.4.1 Rocket.Chat versions prior to 8.3.3 Rocket.Chat versions prior to 8.2.3 Rocket.Chat versions prior to 8.1.4 Rocket.Chat versions prior to 8.0.5 Rocket.Chat versions prior to 7.13.7 Rocket.Chat versions prior to 7.10.11

Description The sendFileMessage DDP method passes an attacker-supplied file object into the updateFileComplete() function, which merges the data directly into a MongoDB $set update using Object.assign. Because there is no allow-list of writable fields, an attacker can rewrite any column on their own upload record, specifically the store and store-specific path fields.

Recommendations Update to version 8.5.0 Update to version 8.4.1 Update to version 8.3.3 Update to version 8.2.3 Update to version 8.1.4 Update to version 8.0.5 Update to version 7.13.7 Update to version 7.10.11