Path Traversal in Camaleon CMS Allows Arbitrary File Write

Executive Summary

CVE-2026-116009 is a path traversal vulnerability in Camaleon CMS versions before 2.9.3. It allows users with only media permissions to write arbitrary files by including ../ sequences in the name parameter. Attackers can exploit this by sending a base64 data URI to the crop_url media action, writing an ERB template into a theme's views directory. When rendered, this template executes malicious code, enabling remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized files in Camaleon CMS theme directories, particularly in views folders. Look for recently modified files with suspicious names or extensions. Inspect public/tmp directory for unexpected files. Review media upload logs for base64 data URIs or path traversal attempts in the name parameter.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with media permissions to upload malicious files, execute arbitrary code on the server, steal data, or deface the website. It could also lead to unauthorized access to sensitive files or system compromise if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or code execution, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Camaleon CMS to version 2.9.3 or later immediately. Clear the public/tmp directory of any potentially malicious files. Review and restrict media permission roles to prevent unauthorized uploads. Implement additional file upload validation and scanning before processing.

Useful 0 Not Useful 0