Description

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-06T15:16:55.983Z",
  "pubdate": "2026-08-06T15:16:55.983Z",
  "executiveSummary": "OpenChamber version 1.11.7 contains a path traversal vulnerability residing in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw.\nThis vulnerability allows unauthenticated remote attackers to bypass the workspace boundary check enforced by the resolveReadPathFromContext function and the vacuous isPathWithinRoot guard.\nBy supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, unauthorized actors can traverse the underlying file system and read arbitrary files.\nThe impact of this flaw includes the exposure of highly sensitive system and application data, such as JWT signing secrets, SSH private keys, API credentials, and environment variables.\nSuccessful retrieval of the JWT signing secret enables complete authentication bypass through the forging of valid session cookies on password-protected deployments.\nThe risk implication is critical, as it grants unauthenticated external entities full read access to confidential system assets and administrative session capabilities without requiring prior privileges.",
  "technicalDetails": "The vulnerability exists within OpenChamber 1.11.7 inside the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw, which process user-supplied file path inputs.\nThe root cause stems from flaws in the resolveReadPathFromContext function and a vacuous isPathWithinRoot guard that fails to properly restrict file system access when processing specific query parameters.\nAuthentication and privilege requirements are entirely absent, allowing unauthenticated remote attackers interacting with the network-exposed endpoints to initiate exploitation.\nThe attack flow begins when an attacker crafts an HTTP request to one of the vulnerable endpoints (/api/fs/read, /api/fs/stat, or /api/fs/raw).\nTo trigger the vulnerability, the attacker supplies the allowOutsideWorkspace=true query parameter accompanied by an absolute path pointing to a target file outside the intended workspace boundary.\nBecause the validation logic improperly handles the allowOutsideWorkspace=true parameter and the isPathWithinRoot guard evaluates incorrectly, the workspace boundary check is successfully bypassed.\nThe application then reads and serves the contents of the requested absolute path back to the unauthenticated caller.\nPost-exploitation impact is severe; attackers can harvest sensitive system files including JWT signing secrets, SSH private keys, API credentials, and environment variables.\nWith the acquired JWT signing secret, an attacker can forge valid session cookies, achieving full authentication bypass and administrative access on password-protected deployments."
}