CVE-2026-53975

Name of the Vulnerable Software and Affected Versions OpenChamber version 1.11.7

Description An unauthenticated remote code execution issue exists where remote attackers can execute arbitrary shell commands. This occurs when crafted POST requests are sent to the '/api/fs/exec' endpoint, which passes commands directly to the Node.js spawn() function without any allowlist, blocklist, or argument validation. In default Docker deployments where UI PASSWORD is not configured, the authentication middleware is bypassed, allowing attackers to execute OS commands as the application user and retrieve the full command output, including stdout, stderr, and exit code, from the server response.

Recommendations Update OpenChamber version 1.11.7 to a newer version that addresses this issue. Configure the UI PASSWORD variable to enable authentication middleware and prevent unauthenticated access to the '/api/fs/exec' endpoint.