CVE-2026-116009
camaleon-cms: Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
owen2345 camaleon-cms
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 2.9.3camaleon-cmsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- @postac001.bsky.social: Camaleon CMS 2.9.3未満で、メディア権限を持つユーザーがファイルパスを操作して任意のファイルを書き込める脆弱性。攻撃者はERBテンプレートをテーマのviewsディレクトリに書き込み、… CVE-2026-116009 CVSS 8.8 | HIGHBluesky: CVE posts, 24 Oct 2026
- @thehackerwire.bsky.social: 🟠 CVE-2026-116009 - High (8.8) Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the... https://www.thehackerwire.com/vulnerability/CVE-Bluesky: CVE posts, 24 Oct 2026
Description
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.
Text from CVE List
Affected versions 1
- camaleon-cmsaffected: all versions before 2.9.3CVE List
References 7
- github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fdFixvia CVE List
- github.com/owen2345/camaleon-cms/pull/1201Fixvia CVE List
- github.com/owen2345/camaleon-cms/pull/1211Fixvia CVE List
- github.com/owen2345/camaleon-cms/releases/tag/2.9.3Fixvia CVE List
- gist.github.com/lukmanazri/b7e76a1ddc84dc977800013c53f671b5Advisoryvia CVE List
- vulncheck.com/advisories/camaleon-cms-before-2.9.3-path-traversal-rce-via-media-crop-url-actionAdvisoryvia CVE List
- github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb#L277-L287Referencevia CVE List