Vulnerability · Published Aug 6, 2026 · Assigned by VulnCheck

CVE-2026-53976OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter

Critical 9.1

In plain English

A critical-severity path traversal in OpenChamber from Bohdan Triapitsyn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)2.6%top 14.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.

Affected products (as reported)

Vendor	Product	Versions
Bohdan Triapitsyn	OpenChamber	0 – through 1.11.7

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Product Advisory product
Patch Commit patch
https://www.vulncheck.com/advisories/openchamber-path-traversal-file-read-via-allowoutsideworkspace-parameter third-party-advisory