CVE-2026-53975

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation. The authentication middleware becomes a no-op when UI_PASSWORD is not configured, matching the default Docker deployment, enabling attackers to execute arbitrary OS commands as the application user and retrieve full command output including stdout, stderr, and exit code from the server response.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/openchamber/openchamber
https://github.com/openchamber/openchamber/commit/f1b9506132faf6c564a2694c7f33b94421a49b4a
https://www.vulncheck.com/advisories/openchamber-unauthenticated-rce-via-api-fs-exec

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) OpenChamber 1.11.7 contiene una vulnerabilidad de ejecución remota de código no autenticada que permite a atacantes remotos ejecutar comandos de shell arbitrarios enviando solicitudes POST manipuladas al endpoint /API/fs/exec, que pasa los comandos textualmente a Node.js spawn() sin ninguna lista blanca, lista negra o validación de argumentos. El middleware de autenticación se convierte en una operación nula cuando UI_PASSWORD no está configurado, coincidiendo con la implementación predeterminada de Docker, permitiendo a los atacantes ejecutar comandos arbitrarios del sistema operativo como el usuario de la aplicación y recuperar la salida completa del comando, incluyendo stdout, stderr y el código de salida de la respuesta del servidor.

Information

Published : 2026-08-06 15:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-53975

Mitre link : CVE-2026-53975

CVE.ORG link : CVE-2026-53975

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-53975", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53975", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-06T14:45:17.465214Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Bohdan Triapitsyn", "product": "OpenChamber", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.11.7"}], "defaultStatus": "affected"}]}], "published": "2026-08-06T15:16:55.827", "references": [{"url": "https://github.com/openchamber/openchamber", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/openchamber/openchamber/commit/f1b9506132faf6c564a2694c7f33b94421a49b4a", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/openchamber-unauthenticated-rce-via-api-fs-exec", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation. The authentication middleware becomes a no-op when UI_PASSWORD is not configured, matching the default Docker deployment, enabling attackers to execute arbitrary OS commands as the application user and retrieve full command output including stdout, stderr, and exit code from the server response."}, {"lang": "es", "value": "OpenChamber 1.11.7 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo no autenticada que permite a atacantes remotos ejecutar comandos de shell arbitrarios enviando solicitudes POST manipuladas al endpoint /API/fs/exec, que pasa los comandos textualmente a Node.js spawn() sin ninguna lista blanca, lista negra o validaci\u00f3n de argumentos. El middleware de autenticaci\u00f3n se convierte en una operaci\u00f3n nula cuando UI_PASSWORD no est\u00e1 configurado, coincidiendo con la implementaci\u00f3n predeterminada de Docker, permitiendo a los atacantes ejecutar comandos arbitrarios del sistema operativo como el usuario de la aplicaci\u00f3n y recuperar la salida completa del comando, incluyendo stdout, stderr y el c\u00f3digo de salida de la respuesta del servidor."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}