An unauthenticated path traversal vulnerability in Rocket.Chat, specifically within the CustomSounds component, creates a high risk of unauthorized file access.

The application is susceptible to a path traversal (LFI) flaw due to improper input validation within the /custom-sounds/ functionality. This vulnerability is exploitable by unauthenticated remote attackers.

A successful exploit allows an attacker to read arbitrary files from the underlying server filesystem. This could lead to the exposure of sensitive configuration files, environment variables, or other proprietary data, potentially resulting in a full system compromise. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to data confidentiality.

Immediate Action: Update Rocket.Chat to the latest version or one of the patched releases (8.2.0, 8.1.1, 8.0.2, 7.13.4, 7.12.5, 7.11.5, or 7.10.8) immediately.

Proactive Monitoring: Review web server and application logs for unusual file access patterns or strings containing directory traversal sequences (such as ../).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts targeting the /custom-sounds/ endpoint.

Public Exploit Available: Unknown

The risk associated with this path traversal vulnerability is severe due to the lack of required authentication. Administrators should prioritize patching their Rocket.Chat instances to the specified versions to eliminate the risk of unauthorized file disclosure.