CVE-2026-53976

Name of the Vulnerable Software and Affected Versions OpenChamber version 1.11.7

Description An issue exists in the file-serving endpoints '/api/fs/read', '/api/fs/stat', and '/api/fs/raw' that allows unauthenticated remote attackers to read arbitrary files. By providing an absolute path and setting the allowOutsideWorkspace query parameter to true, attackers can bypass the workspace boundary check within the resolveReadPathFromContext() function. This occurs because the isPathWithinRoot guard is vacuous, potentially exposing sensitive data such as JWT signing secrets, SSH private keys, API credentials, and environment variables, which could lead to a full authentication bypass via forged session cookies on password-protected deployments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the allowOutsideWorkspace parameter in the '/api/fs/read', '/api/fs/stat', and '/api/fs/raw' endpoints.