{"schema":"threatline.record/2","record":{"id":"CVE-2026-116009","aliases":[],"summary":"Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action","details":"Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.","categories":["Unclassified"],"product":"camaleon-cms","vendor":"owen2345","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116009","source_modified_at":"2026-10-24T11:40:28.810Z","fetched_at":"2026-10-24T14:26:37.433577Z","product":"camaleon-cms","vendor":"owen2345","versions":[{"version":"0","lessThan":"2.9.3","versionType":"custom","status":"affected"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116009","source_modified_at":"2026-10-24T11:40:28.810Z","fetched_at":"2026-10-24T14:26:37.433577Z","package":{"name":"camaleon-cms","ecosystem":null},"version":"2.9.3","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-24T11:40:28.810Z","modified_at":"2026-10-24T11:40:28.810Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116009","fetched_at":"2026-10-24T14:26:37.433577Z","source_modified_at":"2026-10-24T11:40:28.810Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fd","tags":["patch"]},{"source":"CVE List","url":"https://github.com/owen2345/camaleon-cms/pull/1201","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/owen2345/camaleon-cms/pull/1211","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb#L277-L287","tags":["technical-description"]},{"source":"CVE List","url":"https://gist.github.com/lukmanazri/b7e76a1ddc84dc977800013c53f671b5","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3","tags":["release-notes"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.3-path-traversal-rce-via-media-crop-url-action","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-24T11:40:28.810Z","content_hash":"de8804861e7d54df395ffb9e96de49e6fd57fa5f63f3a036f1b4243f614fdeae"}}