OpenChamber 1.11.7 has an unauthenticated remote code execution flaw in its /api/fs/exec API endpoint. The endpoint passes shell commands directly to Node.js spawn() without any validation or filtering, allowing a malicious actor to execute arbitrary operating‑system commands. The response includes full command output, exposing stdout, stderr, and the exit code to the attacker. The vulnerability is an instance of OS Command Injection (CWE‑78).

The affected product is OpenChamber by Bohdan Triapitsyn, version 1.11.7. The default Docker deployment does not configure UI_PASSWORD, which causes the authentication middleware to become a no‑op, enabling unauthenticated access to the vulnerable endpoint.

The CVSS score of 9.3 indicates a high severity flaw. The EPSS score is 1%, and the vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw—unauthenticated remote command execution—makes it highly attractive to attackers. The likely attack vector is a remotely reachable HTTP POST to /api/fs/exec; the attacker does not require any prior authentication or privileged credentials. Once accessed, the attacker can run any shell command as the application user and retrieve the complete output from the server response.