CVE-2026-1776
Path Traversal in Camaleon CMS AWS S3 Uploader Allows File Disclosure
Publication date: 2026-03-10
Last updated on: 2026-04-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tuzitio | camaleon_cms | From 2.4.5 (inc) to 2.9.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-1776 is a path traversal vulnerability in Camaleon CMS versions 2.4.5.0 through 2.9.0, specifically in the AWS S3 uploader backend. The issue occurs because the AWS uploader does not properly validate file paths in the download_private_file functionality, unlike the local uploader. This allows authenticated users, even those with low privileges, to supply directory traversal sequences via the file parameter and read arbitrary files from the web server's filesystem, including sensitive files like /etc/passwd."}, {'type': 'paragraph', 'content': 'The vulnerability bypasses an incomplete fix for a previous issue (CVE-2024-46987) and affects deployments using the AWS S3 storage backend.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability allows any authenticated user, including those with low privileges, to read arbitrary files on the web server's filesystem by exploiting path traversal in the AWS S3 uploader. This can lead to exposure of sensitive information stored on the server, such as configuration files, credentials, or system files like /etc/passwd."}, {'type': 'paragraph', 'content': 'Such unauthorized access can compromise the confidentiality of data, potentially leading to further attacks or data breaches.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the AWS S3 uploader functionality of Camaleon CMS for path traversal attempts in the file parameter of the download_private_file functionality. Specifically, you can attempt to supply directory traversal sequences such as "../" in the file parameter while authenticated to see if arbitrary files like /etc/passwd can be accessed.'}, {'type': 'paragraph', 'content': 'Since the vulnerability affects authenticated users, detection involves authenticated requests to the vulnerable endpoint with crafted file path inputs to check if unauthorized file reads are possible.'}, {'type': 'paragraph', 'content': 'No explicit commands are provided in the resources, but a typical approach would be to use tools like curl or Burp Suite to send authenticated HTTP requests to the download_private_file endpoint with payloads such as file=../../../../etc/passwd and observe if the contents of sensitive files are returned.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate mitigation step is to upgrade Camaleon CMS to a version that includes the fix for CVE-2026-1776, specifically the commit f54a77e or later, which adds strict validation of file and folder paths in the AWS S3 uploader backend.'}, {'type': 'list_item', 'content': 'Apply the patch that introduces the valid_folder_path? method to validate and reject file paths containing directory traversal sequences (e.g., "../") or URI-like schemes (e.g., "file://", "s3://", "https://").'}, {'type': 'list_item', 'content': 'Ensure that the methods add_file, delete_folder, and delete_file in the AWS uploader return errors and do not perform any AWS S3 operations if invalid paths are detected.'}, {'type': 'paragraph', 'content': 'If upgrading immediately is not possible, restrict access to the AWS S3 uploader functionality to trusted users only and monitor for suspicious file access patterns.'}] [2, 4]