Vulnerability · Published Oct 24, 2026 · Assigned by VulnCheck
CVE-2026-116009Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
High 8.8
In plain English
A high-severity path traversal in camaleon-cms from owen2345. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 64.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| owen2345 | camaleon-cms | 0 – before 2.9.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fd patch
- https://github.com/owen2345/camaleon-cms/pull/1201 patch, issue-tracking
- https://github.com/owen2345/camaleon-cms/pull/1211 issue-tracking, patch
- https://github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb#L277-L287 technical-description
- camaleon-cms 2.9.3 Release Notes release-notes
- VulnCheck Advisory: Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action third-party-advisory