Unauthenticated Remote Code Execution in OpenChamber

OpenChamber version 1.11.7 is susceptible to a critical unauthenticated remote code execution vulnerability (CVE-2026-53975). The vulnerability exists in the /api/fs/exec endpoint, which passes user-provided input directly to the Node.js spawn() function without any validation or sanitization. Furthermore, the application's authentication middleware fails to enforce security when the UI_PASSWORD environment variable is unset. As the default Docker deployment configuration leaves this variable unconfigured, most deployments are exposed to unauthenticated exploitation. An attacker can submit a crafted POST request to trigger arbitrary command execution as the application user, resulting in the server returning the full command output, including stdout, stderr, and the exit code. This poses a significant risk to the integrity and availability of the host environment, particularly in containerized deployments.

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the host machine with the privileges of the OpenChamber application user. This could lead to full system compromise, data exfiltration, or deployment of further malicious payloads. The scope of impact is high, as the vulnerability resides in the default configuration for containerized environments.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Deploy the provided webserver detection rule to identify malicious POST requests targeting the /api/fs/exec endpoint.
• Audit all OpenChamber deployments to ensure the UI_PASSWORD environment variable is explicitly configured to a strong, unique password.
• Update OpenChamber to the latest patched version once available.
• Implement egress network filtering to prevent the application container from initiating unauthorized external connections.