PT-2026-24112 · Unknown · Camaleon Cms

Michael Loomis + 1 · Published 2026-03-09 · Updated 2026-03-10 · CVE-2026-1776

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions 2.4.5.0 through 2.9.0

Description Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, have a path traversal issue in the AWS S3 uploader implementation. Authenticated users can read arbitrary files from the web server’s filesystem. The issue is present in the download private file functionality when using the CamaleonCmsAwsUploader backend. The application does not validate file paths, allowing directory traversal sequences through the file parameter. This allows any authenticated user to access sensitive files, such as /etc/passwd. This is a bypass of a previous fix.

Recommendations Update Camaleon CMS to a version prior to 2.9.0 that includes commit f54a77e.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-1776

GHSA-JW5G-F64P-6X78

Affected Products

Camaleon Cms

References · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2026-1776.yml · Exploit
• https://github.com/owen2345/camaleon-cms/pull/1127 · Patch
• https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1776 · Security Note
• https://vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read · Patch
• https://osv.dev/vulnerability/GHSA-jw5g-f64p-6x78 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1776 · Vendor Advisory
• https://github.com/owen2345/camaleon-cms · Note
• https://t.me/cveNotify/154892 · Telegram Post
• https://camaleon.website · Note
• https://twitter.com/CVEnew/status/2031122509739749836 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2031325657053966793 · Twitter Post