CVE-2026-1776
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A path traversal vulnerability in Camaleon CMS versions 2.4.5.0 through 2.9.0 (prior to commit f54a77e) in the AWS S3 uploader implementation. Authenticated users can read arbitrary files from the web server's filesystem by manipulating the 'file' parameter in the download_private_file function.
Risk Assessment
The risk involves the ability for any authenticated user, including low-privileged accounts, to read sensitive system files (e.g., /etc/passwd). This could lead to credential disclosure or exposure of other confidential information.
Recommendation
Immediately update Camaleon CMS to a version containing commit f54a77e or later. If an update is not possible, temporarily disable the AWS S3 backend or restrict access to the download_private_file function.
Other vulnerabilities in Camaleon CMS
See all- CVE-2026-86100Medium
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the 'Upload from URL' media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.
- CVE-2026-67616Medium
Camaleon CMS up to version 2.9.2 (fixed in commit 88ab703) contains a missing authorization vulnerability on the drafts endpoint. Any authenticated low-privileged user can create draft posts by bypassing role and permission checks, sending requests to the drafts endpoint using only session authentication.
- CVE-2026-66748High
A vulnerability in Camaleon CMS allows an authenticated user with custom field management permissions to execute arbitrary Ruby code. A malicious expression in the select_eval field is evaluated via instance_eval when rendering the post edit page.
- CVE-2026-10715Medium
Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary post_id to POST /admin/post_type/<POST_TYPE_ID>/drafts and overwrite the draft associated with another user's post.
Original NVD description (English source)
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS