CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-53976 — OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving e...

·Source: NIST NVD

Updated:

Executive Summary

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPath

Analysis

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments. CVSS Score: 9.1. Published: 2026-08-06T15:16:55.983.

Indicators of Compromise (1)

CVE (1)
CVE-2026-53976
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 6, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs

An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it, re-poisoning the predictor after the defense has run. MIT CSAIL researchers Daniël Trujillo and Mengjia Yan named the technique INTERRUPT INJECTION. On an AMD Zen 2 machine running Linux 6.14 with every default Spectre v2 mitigation on,

The Hacker News
HIGHVulnerability

NVD HIGH: CVE-2026-53985 — Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vuln...

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enfor

CVE-2026-53985
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-53977 — OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows u...

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown ha

CVE-2026-53977
NIST NVD