Live › vulnerability › CVE-2026-116009
Go to dashboardCamaleon CMS before 2.9.3 has a path traversal in the media crop_url action that lets a user with only media permission write arbitrary files using ../ sequences in the name parameter. The write can place an ERB template in a theme's views directory, which runs when the page renders, giving the attacker code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Sites running Camaleon CMS before 2.9.3 where some users hold the media permission without full administrative rights. Sites that only grant media access to administrators, or that run a patched version, are not exposed to this path.
No product ranges from the sources yet.
camaleon_cms entry in the Gemfile.lock; versions below 2.9.3 are affected.2.9.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.
This page as .md · .json · in your agent: get_signal("CVE-2026-116009")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.