CVE-2026-116009 in Camaleon CMS
Summary
by MITRE • 10/24/2026
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in Camaleon CMS versions prior to 2.9.3 represents a critical security flaw rooted in improper input validation and path traversal weaknesses within its media management subsystem. This issue specifically affects users who possess only the media permission level, highlighting that even restricted user roles can achieve significant system compromise due to insufficient access controls on file operations. The core technical failure lies in how the application handles the name parameter during file upload or manipulation processes. When a user supplies directory traversal sequences such as ../ within this parameter, the CMS fails to properly sanitize or canonicalize the path before writing files to the server's filesystem. This lack of validation allows an attacker to break out of the intended target directory and write arbitrary files into sensitive locations on the web server.
The operational impact of this vulnerability is severe because it facilitates a remote code execution scenario through template injection. An attacker can exploit the crop_url media action by crafting a request that includes a base64-encoded data URI as part of the file content or name manipulation. By doing so, they are able to write an ERB (Embedded Ruby) template directly into one of the theme's views directories. Since Camaleon CMS uses these view templates for rendering web pages, any malicious code embedded within them will be executed by the server when a user visits the affected page. This effectively grants the attacker full control over the application logic and potentially the underlying operating system, depending on the privileges under which the web server process runs.
From an industry standard perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The ability to write arbitrary files also touches upon CWE-436: Interpretation Error and CWE-94: Improper Control of Generation of Code (Code Injection), specifically through the injection of server-side template code. In terms of attack tactics, this exploitation method corresponds to MITRE ATT&CK technique T1505.003: Server Side Template Injection, where attackers inject malicious scripts into templates that are later executed by a web application. Additionally, the initial access vector relates to T1190: Exploit Public-Facing Application, as it leverages a flaw in an externally accessible service.
Mitigation strategies must focus on immediate patching and robust input validation. The primary remediation is to upgrade Camaleon CMS to version 2.9.3 or later, where the developers have addressed these path traversal issues by implementing stricter file name sanitization and directory restriction mechanisms. For systems that cannot be immediately patched, administrators should enforce strict access controls on the media upload functionality, potentially restricting write permissions for lower-privileged users entirely if not strictly required. Furthermore, deploying a Web Application Firewall can help detect and block requests containing suspicious path traversal sequences or base64-encoded payloads targeting sensitive directories like views. Regular security audits of file handling routines are essential to prevent similar vulnerabilities in other parts of the application stack.