CVE-2026-116009: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in owen2345 camaleon-cms
Affects owen2345 camaleon-cmsSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NWhat to do
AI-suggested
A fix is available in Camaleon CMS version 2.9.3. Users should upgrade to version 2.9.3 or later to remediate this vulnerability. No vendor advisory content was provided, so patch status is inferred from the version information. There is no indication that temporary mitigations or workarounds are available.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| owen2345camaleon-cms | Affected
| Fixed in
|
GitHub Actionscamaleon-cmspkg:github/camaleon-cmsOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
Camaleon CMS versions before 2.9.3 have a path traversal vulnerability that allows users with media permissions to write arbitrary files by manipulating the name parameter with ../ sequences. This can be exploited by sending a base64 data URI to the crop_url media action, enabling attackers to write an ERB template into a theme's views directory, which executes when rendered.
References
- github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fd (opens in a new tab)
- github.com/owen2345/camaleon-cms/pull/1201 (opens in a new tab)
- github.com/owen2345/camaleon-cms/pull/1211 (opens in a new tab)
- github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb (opens in a new tab)
- gist.github.com/lukmanazri/b7e76a1ddc84dc977800013c53f671b5 (opens in a new tab)
- github.com/owen2345/camaleon-cms/releases/tag/2.9.3 (opens in a new tab)
- vulncheck.com/advisories/camaleon-cms-before-2.9.3-path-traversal-rce-via-media-crop-url-action (opens in a new tab)