Loading...
Skip to main content
GeekWala

CVE-2026-1776 — Vulnerability in camaleon_cms — CVE Details

MEDIUM

Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

Published March 10, 2026Updated May 5, 2026Source: osv

Summary

Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.

Advisory Timeline

  • First published March 10, 2026 (216 days ago).
  • Last revised May 5, 2026 — 56 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: rubygems (1).

PackageEcosystemAffectedFixed In
camaleon_cms
rubygems
2.4.5, 2.4.5.1, 2.4.5.10, 2.4.5.11 (+43 more)Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Frequently Asked Questions

What is CVE-2026-1776?
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2026-1776?
CVE-2026-1776 affects camaleon_cms. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-1776 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-jw5g-f64p-6x78

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies