Read the docs
TI-2026-80078 Aliases CVE-2026-116009GHSA-wq77-q3hj-c75x

Path traversal in Camaleon CMS lets media users write executable templates

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Camaleon CMS before 2.9.3 contains a path traversal flaw (CWE-22) in which the name parameter accepts ../ sequences, so a user with only the media permission can write arbitrary files. An attacker can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, where it runs when rendered. The CVSS 4.0 vector shows network attack with low privileges and no user interaction, with high impact to confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed camaleon-cms (owen2345): 2.9.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
owen2345camaleon-cmsbefore 2.9.32.9.3Patch availableCNA
  • camaleon-cms Vendorowen2345 Affected before 2.9.3 Fixed in 2.9.3 Patch available CNA

Remediation

Update owen2345 camaleon-cms to version 2.9.3 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA camaleon-cms (owen2345) Fixed in 2.9.3

Timeline

  1. 2026-10-24 Threatist record created from CVE-2026-116009
  2. 2026-10-24 Alias added: GHSA-wq77-q3hj-c75x
  3. 2026-10-25 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-10-29 Priority changed: LOW → MEDIUM

References

Patch 3

Other 2

  • TI-2023-14148 Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI)… CVSS 3.1CRITICAL 9.8
  • TI-2024-31375 Arbitrary file write leading to RCE in Camaleon CMS CVSS 3.1CRITICAL 10.0
  • TI-2026-47396 Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field CVSS 4.0HIGH 8.7
  • TI-2021-07976 Camaleon CMS - Insufficient Session Expiration after Password Change CVSS 3.1HIGH 8.8
  • TI-2024-31376 Arbitrary path traversal in Camaleon CMS CVSS 3.1HIGH 7.7
  • TI-2026-51449 CamaleonCMS Missing Authorization via Plugin Administration Endpoints CVSS 4.0HIGH 7.2
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences