Vulnerability Description
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/upl
- https://github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec21
- https://github.com/owen2345/camaleon-cms/pull/1201
- https://github.com/owen2345/camaleon-cms/pull/1211
- https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3
- https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.3-path-traversal-rc
FAQ
What is CVE-2026-116009?
CVE-2026-116009 is a vulnerability with a CVSS score of 8.8 (HIGH). Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers ...
How severe is CVE-2026-116009?
CVE-2026-116009 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116009?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.