A path traversal vulnerability exists in OpenChamber 1.11.7's file‑serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw. By including the query parameter allowOutsideWorkspace=true together with an absolute file path, an unauthenticated attacker can bypass the workspace boundary check implemented in resolveReadPathFromContext and read any file on the host system. This flaw is a classic CWE‑22 example that enables the attacker to expose sensitive information such as the JWT signing secret, SSH private keys, API credentials, and environment variables, which can be used to forge session cookies and bypass authentication on password‑protected deployments.

The vulnerability affects the OpenChamber web application developed by Bohdan Triapitsyn, specifically the 1.11.7 release. No other versions are listed as affected in the available data, but any installation using this exact version should be considered vulnerable.

With a CVSS score of 9.3, this flaw is rated critical, and although the EPSS score is not available, the lack of authentication requirements and the simplicity of the required HTTP request make it highly attractive for exploitation. The flaw is not yet listed in the CISA KEV catalog, but the severity and potential for credential compromise indicate that attackers could readily use publicly available tools to exploit the parameter and read arbitrary files from the host, thereby gaining full access to the system.