CVE-2026-102261
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.
Risk Assessment
A remote attacker can bypass authorization and perform unauthorized media operations, potentially leading to data integrity breaches and unauthorized access.
Recommendation
Update Camaleon CMS to version 2.9.3 or apply patch c143e145caa600947e70a240e87f2fed889149d3.
Other vulnerabilities in Camaleon CMS
See all- CVE-2026-86100Medium
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the 'Upload from URL' media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.
- CVE-2026-67616Medium
Camaleon CMS up to version 2.9.2 (fixed in commit 88ab703) contains a missing authorization vulnerability on the drafts endpoint. Any authenticated low-privileged user can create draft posts by bypassing role and permission checks, sending requests to the drafts endpoint using only session authentication.
- CVE-2026-66748High
A vulnerability in Camaleon CMS allows an authenticated user with custom field management permissions to execute arbitrary Ruby code. A malicious expression in the select_eval field is evaluated via instance_eval when rendering the post edit page.
- CVE-2026-10715Medium
Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary post_id to POST /admin/post_type/<POST_TYPE_ID>/drafts and overwrite the draft associated with another user's post.
- CVE-2026-1776Medium
A path traversal vulnerability in Camaleon CMS versions 2.4.5.0 through 2.9.0 (prior to commit f54a77e) in the AWS S3 uploader implementation. Authenticated users can read arbitrary files from the web server's filesystem by manipulating the 'file' parameter in the download_private_file function.
Original NVD description (English source)
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS