Rocket.Chat versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11 contain a vulnerability in the sendFileMessage DDP method. This method passes the entire attacker-controlled file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update using Object.assign without an allow-list of writable fields. Consequently, an attacker can rewrite any column on their own upload record, notably the store and store-specific path fields. This improper control of dynamically-determined object attributes (CWE-915) can lead to unauthorized modification of upload metadata. The vulnerability has a CVSS 3.1 score of 8.5 (high severity) with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality highly and integrity partially, with no impact on availability. The issue is fixed in the listed versions.

An attacker with low privileges can exploit this vulnerability remotely over the network without user interaction to modify arbitrary attributes of their own uploaded files in Rocket.Chat. This includes critical fields such as storage location and path, potentially leading to unauthorized access or manipulation of stored files. The confidentiality impact is high, integrity impact is low, and availability is unaffected. There are no known exploits in the wild as of the publication date.

A fix is available in Rocket.Chat versions 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11. Users should upgrade to one of these fixed versions to remediate this vulnerability. Patch status is confirmed by the vendor advisory embedded in the description. No additional mitigation steps are indicated.