CVE-2026-86100: medium-severity vulnerability in owen2345 CamaleonCMS
Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
owen2345 · CamaleonCMSRelated CVEs — owen2345 CamaleonCMS
In the same product, most dangerous first.
CVE-2026-73330HIGHCamaleonCMS 2.9.1 Server-Side Template Injection via test_email ActionEPSS 0.8%CVE-2026-56721HIGHCamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersControllerEPSS 0.5%CVE-2026-73332CRITICALCamaleonCMS cama_contact_form Plugin Stored XSS via before_html FieldEPSS 0.4%CVE-2026-73329CRITICALCamaleonCMS Stored XSS via Draft Post Title Creation EndpointEPSS 0.4%CVE-2026-73326HIGHCamaleonCMS Missing Authorization via Plugin Administration EndpointsEPSS 0.4%CVE-2026-73331HIGHCamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug FieldEPSS 0.4%
References
https://github.com/owen2345/camaleon-cmshttps://github.com/owen2345/camaleon-cms/blob/2.9.1/app/helpers/camaleon_cms/uploader_helper.rbhttps://github.com/owen2345/camaleon-cms/commit/3c46b6e512518ded476226162305c8eae00aac3fhttps://github.com/owen2345/camaleon-cms/pull/1133https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2https://www.vulncheck.com/advisories/camaleon-cms-2.7.5-through-2.9.1-ssrf-via-http-redirect-in-upload-from-url