Path Traversal Vulnerability in Camaleon CMS by Owen2345

CVE-2026-116009

What is CVE-2026-116009?

Camaleon CMS prior to version 2.9.3 is susceptible to a path traversal vulnerability. This flaw enables users who possess only media permissions to exploit the system by inputting '../' sequences in the name parameter. An attacker can leverage this vulnerability by sending a base64 data: URI to the media crop_url action, subsequently allowing them to write an ERB template into a theme's views directory. This malicious file, once rendered, can execute arbitrary code, posing a significant security risk to affected installations.

References