Path Traversal Vulnerability in Camaleon CMS by Camaleon

CVE-2026-1776

What is CVE-2026-1776?

Camaleon CMS versions ranging from 2.4.5.0 to 2.9.0 have a path traversal vulnerability within the implementation of the AWS S3 uploader. This flaw allows authenticated users to exploit the system and read arbitrary files from the server's filesystem. Specifically, when the application employs the CamaleonCmsAwsUploader backend, the download_private_file function fails to enforce proper validation of file paths, allowing attackers to use directory traversal sequences through the file parameter. This oversight makes it possible for authenticated users, including those with minimal privileges, to access sensitive files like /etc/passwd, potentially leading to significant security breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References