CVE-2026-86100mediumCWE-918

CVE-2026-86100: falha de média gravidade em owen2345 CamaleonCMS

Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar CamaleonCMS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
owen2345 · CamaleonCMS
CVEs relacionadas — owen2345 CamaleonCMS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-73330HIGHCamaleonCMS 2.9.1 Server-Side Template Injection via test_email ActionEPSS 0.8%CVE-2026-56721HIGHCamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersControllerEPSS 0.5%CVE-2026-73332CRITICALCamaleonCMS cama_contact_form Plugin Stored XSS via before_html FieldEPSS 0.4%CVE-2026-73329CRITICALCamaleonCMS Stored XSS via Draft Post Title Creation EndpointEPSS 0.4%CVE-2026-73326HIGHCamaleonCMS Missing Authorization via Plugin Administration EndpointsEPSS 0.4%CVE-2026-73331HIGHCamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug FieldEPSS 0.4%