CVE-2026-116009: falha de alta gravidade em owen2345 camaleon-cms
Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
owen2345 · camaleon-cmsCVEs relacionadas — owen2345 camaleon-cms
No mesmo produto, das mais perigosas para as menos.
CVE-2024-46986CRITICALArbitrary file write leading to RCE in Camaleon CMSEPSS 37.1%CVE-2024-46987HIGHArbitrary path traversal in Camaleon CMSEPSS 14.6%CVE-2026-66748HIGHCamaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom FieldEPSS 1.1%CVE-2025-2304CRITICALCamaleon CMS Privilege EscalationEPSS 0.6%CVE-2026-67616MEDIUMCamaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpointEPSS 0.4%
Referências
https://github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb#L277-L287https://github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fdhttps://github.com/owen2345/camaleon-cms/pull/1201https://github.com/owen2345/camaleon-cms/pull/1211https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.3-path-traversal-rce-via-media-crop-url-action