OpenChamber unauthenticated RCE via /api/fs/exec (CVE-2026-53975)

critical severity · published 2026-08-06

Anyone who can reach OpenChamber can run arbitrary shell commands on the host by sending a crafted POST request to the /api/fs/exec endpoint, which forwards commands to Node.js spawn() with no validation. With the default setup (UI_PASSWORD not set, as in the default Docker deployment) there is no authentication, so the attacker gets command output including stdout, stderr, and exit code as the application user.

CVE: CVE-2026-53975

Source: NVD

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 128 and your operating system.