Rocket.Chat versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11 contain a vulnerability (CWE-915) in the sendFileMessage DDP method. This method passes the entire attacker-controlled file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update using Object.assign without an allow-list of writable fields. Consequently, an attacker with permission to upload files can rewrite any column on their own upload record, including sensitive fields such as store and store-specific path fields. This improper control of dynamically-determined object attributes can lead to unauthorized modification of upload metadata. The vulnerability is addressed in the specified fixed versions.

An attacker with privileges to invoke the sendFileMessage method can modify arbitrary attributes of their own file upload records in the database. This includes critical fields that control storage location and path, potentially enabling unauthorized access or manipulation of stored files. The vulnerability impacts confidentiality (high), integrity (low), and does not affect availability. The attack requires network access and low complexity with no user interaction. There are no known exploits in the wild at this time.

This vulnerability is fixed in Rocket.Chat versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11. Users should upgrade to one of these versions or later to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.