Read the docs
TI-2024-31376 Aliases CVE-2024-46987GHSA-cp65-5m9r-vc2c

Arbitrary path traversal in Camaleon CMS

Priority HIGH 67CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.1456 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed camaleon-cms (owen2345): 2.8.2camaleon_cms (RubyGems): 2.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
owen2345camaleon-cmsbefore 2.8.22.8.2Patch availableCNA
—camaleon_cms (RubyGems)before 2.8.12.8.1Patch availableGHSA-cp65-5m9r-vc2c
  • camaleon-cms Vendorowen2345 Affected before 2.8.2 Fixed in 2.8.2 Patch available CNA
  • camaleon_cms (RubyGems) Vendor— Affected before 2.8.1 Fixed in 2.8.1 Patch available GHSA-cp65-5m9r-vc2c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*2.8.0 to before 2.8.2Vulnerableowen2345
  • cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:* Versions 2.8.0 to before 2.8.2 Vulnerable ·owen2345

Remediation

  • Fix · CNA camaleon-cms (owen2345) Fixed in 2.8.2
  • Fix · GHSA-cp65-5m9r-vc2c camaleon_cms (RubyGems) Fixed in 2.8.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-46987
  2. 2026-10-03 Alias added: GHSA-cp65-5m9r-vc2c

References

Exploit 1

Patch 1

Advisory 3

Other 4

  • TI-2023-14148 Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI)… CVSS 3.1CRITICAL 9.8
  • TI-2024-31375 Arbitrary file write leading to RCE in Camaleon CMS CVSS 3.1CRITICAL 10.0
  • TI-2021-07976 Camaleon CMS - Insufficient Session Expiration after Password Change CVSS 3.1HIGH 8.8
  • TI-2021-07975 Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments CVSS 3.1MEDIUM 6.1
  • TI-2021-07978 Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature CVSS 3.1MEDIUM 4.9
  • TI-2024-32457 Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to… CVSS 3.1MEDIUM 4.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences