Skip to main content

OpenChamber CVE-2026-53976

| EUVDEUVD-2026-53936 CRITICAL
Path Traversal (CWE-22)
2026-08-06 VulnCheck GHSA-9wgq-4cmq-jhvv
Path Traversal Authentication Bypass Openchamber
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Unauthenticated network file read (C:H) whose stolen signing secret realistically enables cookie forgery and account takeover (I:H); no availability impact and scope unchanged within the app.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 06, 2026 - 15:17 vuln.today
Analysis Generated
Aug 06, 2026 - 15:17 vuln.today
CVE Published
Aug 06, 2026 - 14:24 cve.org
CRITICAL 9.3

DescriptionCVE.org

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.

AnalysisAI

Unauthenticated arbitrary file read in OpenChamber 1.11.7 lets remote attackers pull any file off the host by setting the allowOutsideWorkspace=true query parameter with an absolute path against the /api/fs/read, /api/fs/stat, and /api/fs/raw endpoints. Because the workspace boundary check in resolveReadPathFromContext relies on a vacuous isPathWithinRoot guard, attackers can harvest the JWT signing secret, SSH private keys, and API credentials, then forge session cookies to fully bypass authentication on password-protected deployments. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Reach network-exposed OpenChamber endpoint
Delivery
Send /api/fs/read with allowOutsideWorkspace=true + absolute path
Exploit
Bypass vacuous isPathWithinRoot guard
Install
Read JWT signing secret and SSH/API credentials
C2
Forge valid session cookie
Execute
Authenticate as privileged user
Impact
Full workspace and host compromise
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that OpenChamber 1.11.7's file-serving endpoints (/api/fs/read, /api/fs/stat, /api/fs/raw) be network-reachable and that the attacker include the allowOutsideWorkspace=true query parameter together with an absolute filesystem path - that parameter, which the vacuous isPathWithinRoot guard fails to police, IS the core enabling condition and is fully attacker-controlled, so no server-side misconfiguration is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment All available signals point to genuine high priority for anyone exposing OpenChamber on a network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach an OpenChamber instance bound to 0.0.0.0 (e.g., a Docker deployment on a shared network or the internet) sends a single unauthenticated GET to /api/fs/read with allowOutsideWorkspace=true and an absolute path such as the JWT secret or SSH key file. With the secret in hand they forge a valid session cookie and log in as a privileged user, gaining full control of the workspace. …
Remediation Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor fix from commit f1b9506132faf6c564a2694c7f33b94421a49b4a (https://github.com/openchamber/openchamber/commit/f1b9506132faf6c564a2694c7f33b94421a49b4a), which replaces the allowOutsideWorkspace trust path with signed, scope-limited outside-file grants, or upgrade to the first tagged release that incorporates it once published. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all OpenChamber 1.11.7 instances and immediately apply the patch available per vendor advisory; review access logs for the /api/fs/read, /api/fs/stat, and /api/fs/raw endpoints with allowOutsideWorkspace=true for evidence of exploitation. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openchamber

View all
CVE-2026-53975 CRITICAL
9.3 Aug 06

Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing t
CVE-2026-53977 HIGH
8.7 Aug 06

Unauthenticated remote shutdown of OpenChamber 1.11.7 is possible by sending a single POST request to /api/system/shutdo

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-53976 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy