CVE-2026-56845

Name of the Vulnerable Software and Affected Versions CustomSounds (affected versions not specified)

Description An unauthenticated path traversal (LFI) vulnerability exists under the '/custom-sounds/' endpoint when CustomSounds storage is configured to FileSystem. Local File Inclusion (LFI) is a type of vulnerability that allows an attacker to read files on the server that they should not have access to. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.