owen2345 Camaleon CMS up to 2.9.0 CamaleonCmsAwsUploader download_private_file File path traversal

Summaryinfo

A vulnerability marked as critical has been reported in owen2345 Camaleon CMS up to 2.9.0. This affects the function download_private_file of the component CamaleonCmsAwsUploader. This manipulation of the argument File causes path traversal. This vulnerability is registered as CVE-2026-1776. Remote exploitation of the attack is possible. No exploit is available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability classified as critical was found in owen2345 Camaleon CMS up to 2.9.0. Affected by this vulnerability is the function download_private_file of the component CamaleonCmsAwsUploader. The manipulation of the argument file with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. The summary by CVE is:

Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.

The weakness was published by Michael Loomis. The advisory is shared at github.com. This vulnerability is known as CVE-2026-1776 since 02/02/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Applying the patch f54a77e is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202603-1962). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• owen2345

Name

• Camaleon CMS

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion