Camaleon CMS: Path traversal leading to remote code execution via media crop_url
Summary
Camaleon CMS before 2.9.3 contains a path traversal flaw in the media crop_url action. An authenticated user with only the media permission can supply ../ sequences in the name parameter and write arbitrary files, including an ERB template into a theme's views directory that executes when rendered. This can lead to code execution on the server.
Affected
- camaleon-cms (Ruby gem) versions 0 to before 2.9.3
- Vulnerable code referenced at tag 2.9.2
Fixed in
- Fixed in 2.9.3
- Fix commit: 430cce27ea63a397a7b7fa0260b4ec2128ea63fd
Workaround
- Unknown (no vendor-published workaround found).
- Third-party suggestion: restrict the media permission to trusted users only.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of exploitation found; not in CISA KEV; no public PoC found in the sources reviewed.
- Sources are about a week old; absence of evidence is not proof.
Our recommendation
- Identify all Camaleon CMS installations and their versions.
- Upgrade to Camaleon CMS 2.9.3 or later.
- Until patched, review who holds the media permission and remove it where not needed.
- Check theme view directories for unexpected or recently modified template files.
- Restrict exposure of the CMS admin interface where possible.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Fix commit 430cce27 github.com
- Camaleon CMS release 2.9.3 github.com
- Vulnerable code at tag 2.9.2 github.com
- Rapid7 vulnerability database www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:22.
Original description (NVD)
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.
NVD references (6)
- https://github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb#L277-L287
- https://github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fd
- https://github.com/owen2345/camaleon-cms/pull/1201
- https://github.com/owen2345/camaleon-cms/pull/1211
- https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3
- https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.3-path-traversal-rce-via-media-crop-url-action
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.