OpenChamber - Path Traversal (CVE-2026-53976)

CVE-2026-53976 is a critical path traversal vulnerability in OpenChamber 1.11.7 that allows unauthenticated remote attackers to read arbitrary files through file-serving API endpoints. Exploitation can expose JWT signing secrets, SSH private keys, API credentials, and environment variables, potentially enabling forged session cookies, authentication bypass, and full compromise of password-protected deployments.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-53976 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-53976 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-53976 is currently experiencing high visibility and active exploitation across the internet.

Attackers target /api/fs/read (and related file-serving endpoints such as /api/fs/stat and /api/fs/raw) with allowOutsideWorkspace=true and an absolute path value to bypass workspace restrictions and read arbitrary files. Attempts may request sensitive locations such as /etc/passwd, configuration files, credentials, or private keys.