OpenChamber vulnerabilities

3 known vulnerabilities in OpenChamber from Bohdan Triapitsyn. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  OpenChamber: Missing Authentication for Critical Functionality

  CVE-2026-53977Aug 6, 2026Bohdan Triapitsyn

  OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middle

• 9.1 Critical severity

  OpenChamber: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-53976Aug 6, 2026Bohdan TriapitsynEPSS 2.61%

  OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query paramete

• 9.8 Critical severity

  OpenChamber: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-53975Aug 6, 2026Bohdan TriapitsynEPSS 1.68%

  OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn()