CVE-2026-53975
Received Received - Intake

Unauthenticated Remote Code Execution in OpenChamber

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description
OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation. The authentication middleware becomes a no-op when UI_PASSWORD is not configured, matching the default Docker deployment, enabling attackers to execute arbitrary OS commands as the application user and retrieve full command output including stdout, stderr, and exit code from the server response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-53975
EUVD
EUVD-2026-53932

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openchamber openchamber 1.11.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenChamber 1.11.7 has an unauthenticated remote code execution vulnerability. Attackers can send crafted POST requests to the /api/fs/exec endpoint to execute arbitrary shell commands. The application passes these commands directly to Node.js's spawn() function without any input validation. If the UI_PASSWORD environment variable is not set—which is the default in Docker deployments—the authentication middleware is bypassed, allowing full OS command execution with the application user's privileges.

Detection Guidance

To detect this vulnerability, check if OpenChamber 1.11.7 or earlier is running and if the /api/fs/exec endpoint is exposed. Use curl to send a test POST request to the endpoint. Example: curl -X POST http://<target-ip>:<port>/api/fs/exec -d '{"cmd":"whoami"}'. If the server responds with command output, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your server as the application user. They can steal data, install malware, modify files, or take control of the system. Since the default Docker deployment lacks UI_PASSWORD, most users are exposed by default. Attackers can retrieve full command output, including sensitive information.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized remote code execution. It enables data breaches, loss of confidentiality, and potential unauthorized access to sensitive data. Organizations using OpenChamber 1.11.7 or earlier may face regulatory penalties for failing to protect personal or health information.

Mitigation Strategies

Immediately upgrade OpenChamber to a version beyond 1.11.7 or apply commit f1b9506. Ensure UI_PASSWORD is set in Docker deployments to enforce authentication. Restrict network access to the /api/fs/exec endpoint and monitor for suspicious POST requests to this path.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53975. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart