CVE-2026-1776

Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://camaleon.website/	Product
https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af	Patch
https://github.com/owen2345/camaleon-cms/pull/1127	Issue Tracking Patch
https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-10 07:38

Updated : 2026-07-14 16:16

NVD link : CVE-2026-1776

Mitre link : CVE-2026-1776

CVE.ORG link : CVE-2026-1776

JSON object : View

Products Affected

tuzitio

camaleon_cms

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-1776", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1776", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:57:09.790742Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/owen2345/camaleon-cms", "vendor": "owen2345", "product": "Camaleon CMS", "versions": [{"status": "affected", "version": "2.4.5.0", "versionType": "custom", "lessThanOrEqual": "2.9.0"}, {"status": "unaffected", "version": "f54a77e2a7be601215ea1b396038c589a0cab9af", "versionType": "git"}], "packageURL": "pkg:github/owen2345/camaleon-cms", "packageName": "camaleon-cms", "defaultStatus": "unaffected"}]}], "published": "2026-03-10T07:38:01.950", "references": [{"url": "https://camaleon.website/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/owen2345/camaleon-cms/pull/1127", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read", "tags": ["Patch", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server\u2019s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend."}, {"lang": "es", "value": "Las versiones 2.4.5.0 a 2.9.0 de Camaleon CMS, anteriores al commit f54a77e, contienen una vulnerabilidad de salto de ruta en la implementaci\u00f3n del cargador de AWS S3 que permite a los usuarios autenticados leer archivos arbitrarios del sistema de archivos del servidor web. El problema ocurre en la funcionalidad download_private_file cuando la aplicaci\u00f3n est\u00e1 configurada para usar el backend CamaleonCmsAwsUploader. A diferencia de la implementaci\u00f3n del cargador local, el cargador de AWS no valida las rutas de archivo con valid_folder_path?, permitiendo que se suministren secuencias de salto de directorio a trav\u00e9s del par\u00e1metro file. Como resultado, cualquier usuario autenticado, incluidos los usuarios registrados con pocos privilegios, puede acceder a archivos sensibles como /etc /passwd. Este problema representa una omisi\u00f3n de la correcci\u00f3n incompleta para CVE-2024-46987 y afecta a las implementaciones que utilizan el backend de almacenamiento de AWS S3."}], "lastModified": "2026-07-14T16:16:47.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CD58B4B-A874-4802-A817-72F4C8104C09", "versionEndIncluding": "2.9.0", "versionStartIncluding": "2.4.5"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}