CVE-2026-56845: CustomSounds Path Traversal Vulnerability

CVE-2026-56845 Overview

CVE-2026-56845 is an unauthenticated path traversal vulnerability affecting applications that expose the /custom-sounds/ endpoint when the CustomSounds feature is configured to use FileSystem storage. An attacker can supply ../ sequences in the request path to read arbitrary files outside the intended base directory. No authentication or user interaction is required to exploit this flaw. The issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Successful exploitation leads to disclosure of sensitive files on the host, including configuration files, credentials, and application source code.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the underlying server, exposing secrets and configuration data that may enable further compromise.

Affected Products

Applications exposing the /custom-sounds/ endpoint
Deployments where CustomSounds storage is configured to FileSystem
See the HackerOne Report #3514640 for vendor and version specifics

Discovery Timeline

2026-08-04 - CVE-2026-56845 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-56845

Vulnerability Analysis

The vulnerability resides in the request handler serving the /custom-sounds/ route. When CustomSounds storage is set to the FileSystem backend, the handler concatenates user-supplied path segments with a base directory before invoking a file read operation. The concatenation logic does not canonicalize the resulting path or verify that it remains within the intended base directory. Attackers exploit this by injecting ../ traversal sequences into the URL path, walking outside the sounds directory to reach arbitrary locations on the filesystem.

The flaw does not require authentication, session tokens, or CSRF prerequisites. A single crafted GET request is sufficient to retrieve file contents. Files accessible to the application service account fall within the disclosure scope. On typical Linux deployments, this includes /etc/passwd, application configuration files, environment files containing API keys, and private keys stored on disk.

Root Cause

The root cause is missing input validation and path canonicalization in the file-serving logic for CustomSounds assets. The handler trusts client-supplied path components rather than normalizing the final resolved path and comparing it against the allowed base directory. This is a textbook CWE-22 implementation error.

Attack Vector

Exploitation occurs over the network against the HTTP interface serving /custom-sounds/. An attacker issues a GET request containing ../ sequences in the path portion following /custom-sounds/. The server resolves the traversal and returns the contents of the target file in the HTTP response body. Technical proof-of-concept details are documented in the HackerOne Report #3514640.

Detection Methods for CVE-2026-56845

Indicators of Compromise

HTTP requests to /custom-sounds/ containing ../, ..%2f, ..%252f, or other encoded traversal sequences
Successful HTTP 200 responses to /custom-sounds/ requests returning non-audio content types
Access log entries showing sequential probing of the /custom-sounds/ path with varying traversal depths
Outbound reads of sensitive files such as /etc/passwd, .env, or private key files correlated with web server activity

Detection Strategies

Deploy web application firewall rules that flag or block traversal patterns in request paths targeting /custom-sounds/
Alert on responses from /custom-sounds/ where the Content-Type does not match expected audio MIME types
Correlate web access logs with filesystem audit logs to identify reads of sensitive files initiated by the web service account

Monitoring Recommendations

Enable verbose HTTP access logging on the affected service and forward logs to a centralized SIEM
Monitor for spikes in 200 responses on the /custom-sounds/ route with unusually long URL paths
Track filesystem access telemetry for the application service account to identify reads outside expected directories

How to Mitigate CVE-2026-56845

Immediate Actions Required

Restrict or disable the /custom-sounds/ endpoint at the reverse proxy or load balancer until a patch is applied
Switch CustomSounds storage away from the FileSystem backend to an object storage backend if supported
Audit web server access logs for prior exploitation attempts targeting /custom-sounds/
Rotate any credentials, tokens, or private keys that resided on the affected host

Patch Information

Refer to the HackerOne Report #3514640 for vendor patch details and remediation guidance. Apply the vendor-supplied update to the affected component as soon as it is available. Patches for CWE-22 typically add path canonicalization and enforce that resolved paths remain within an allowlisted base directory.

Workarounds

Configure the reverse proxy to reject any request path containing ../ or URL-encoded traversal sequences
Enforce a strict allowlist of filenames for the /custom-sounds/ route at the proxy layer
Run the application service under a low-privilege account with filesystem access limited to the sounds directory

bash

# NGINX example: block traversal patterns targeting /custom-sounds/
location /custom-sounds/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|\.\.%252f)") {
        return 403;
    }
    proxy_pass http://backend;
}