OpenChamber version 1.11.7 contains an unauthenticated remote code execution vulnerability (CVE-2026-53975). The vulnerability arises because the /api/fs/exec endpoint accepts POST requests with commands that are passed verbatim to the Node.js spawn() function without any allowlist, blocklist, or argument validation. When the UI_PASSWORD environment variable is not set, which is the default in the Docker deployment, the authentication middleware is effectively disabled. This allows remote attackers to execute arbitrary OS commands as the application user and retrieve the full output including stdout, stderr, and exit code from the server response. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can execute arbitrary operating system commands on the server running OpenChamber 1.11.7. This leads to full compromise of the application user context, including the ability to retrieve command output. The vulnerability affects confidentiality, integrity, and availability of the system. Exploitation does not require authentication or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to configure the UI_PASSWORD environment variable to enable authentication middleware and prevent unauthenticated access to the /api/fs/exec endpoint. Restrict network access to the application to trusted users only and monitor for suspicious POST requests targeting this endpoint.