{"schema_version":"2","view":"grouped","data":[{"id":56288,"cve_ids":["CVE-2026-116009"],"payload":{"kind":"advisory","title":"Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action","summary":"Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.","evidence":"cve:CVE-2026-116009","products":[{"name":{"value":"camaleon-cms","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-116009","aliases":["CVE-2026-116009"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/owen2345/camaleon-cms","vendor":"owen2345","product":"camaleon-cms","versions":[{"status":"affected","version":"0","lessThan":"2.9.3","versionType":"custom"}],"packageURL":"pkg:gem/camaleon_cms","defaultStatus":"unaffected"}],"modified":"2026-10-24T11:40:28.810Z","provider":"cve","references":["https://github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fd","https://github.com/owen2345/camaleon-cms/pull/1201","https://github.com/owen2345/camaleon-cms/pull/1211","https://github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb#L277-L287","https://gist.github.com/lukmanazri/b7e76a1ddc84dc977800013c53f671b5","https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3","https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.3-path-traversal-rce-via-media-crop-url-action"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-24T11:40:28.810Z"}}},"related_cves":[{"value":"CVE-2026-116009","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dabfd404-8187-44e9-b90c-1cf2f5b7eb5d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116009","advisory_id":"dabfd404-8187-44e9-b90c-1cf2f5b7eb5d","event_types":["advisory"],"published_at":"2026-10-25T16:12:23.19958+00:00","technologies":["camaleon-cms","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T11:40:28.81+00:00","detail_url":"/advisories/advisory%3Adabfd404-8187-44e9-b90c-1cf2f5b7eb5d","group":{"id":"advisory:dabfd404-8187-44e9-b90c-1cf2f5b7eb5d","revision":1,"primary_event_id":55811,"change":"published","superseded_by":[],"changed":{"id":55811,"cve_ids":["CVE-2026-116009"],"payload":{"kind":"advisory","title":"Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action","summary":"Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.","evidence":"cve:CVE-2026-116009","products":[{"name":{"value":"camaleon-cms","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-116009","aliases":["CVE-2026-116009"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/owen2345/camaleon-cms","vendor":"owen2345","product":"camaleon-cms","versions":[{"status":"affected","version":"0","lessThan":"2.9.3","versionType":"custom"}],"packageURL":"pkg:gem/camaleon_cms","defaultStatus":"unaffected"}],"modified":"2026-10-24T11:40:28.810Z","provider":"cve","references":["https://github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fd","https://github.com/owen2345/camaleon-cms/pull/1201","https://github.com/owen2345/camaleon-cms/pull/1211","https://github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb#L277-L287","https://gist.github.com/lukmanazri/b7e76a1ddc84dc977800013c53f671b5","https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3","https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.3-path-traversal-rce-via-media-crop-url-action"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-24T11:40:28.810Z"}}},"related_cves":[{"value":"CVE-2026-116009","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dabfd404-8187-44e9-b90c-1cf2f5b7eb5d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116009","advisory_id":"dabfd404-8187-44e9-b90c-1cf2f5b7eb5d","event_types":["advisory"],"published_at":"2026-10-25T16:12:23.19958+00:00","technologies":["camaleon-cms","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T11:40:28.81+00:00","detail_url":"/events/55811"},"members":[{"id":55811,"cve_ids":["CVE-2026-116009"],"payload":{"kind":"advisory","title":"Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action","summary":"Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.","evidence":"cve:CVE-2026-116009","products":[{"name":{"value":"camaleon-cms","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-116009","aliases":["CVE-2026-116009"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/owen2345/camaleon-cms","vendor":"owen2345","product":"camaleon-cms","versions":[{"status":"affected","version":"0","lessThan":"2.9.3","versionType":"custom"}],"packageURL":"pkg:gem/camaleon_cms","defaultStatus":"unaffected"}],"modified":"2026-10-24T11:40:28.810Z","provider":"cve","references":["https://github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fd","https://github.com/owen2345/camaleon-cms/pull/1201","https://github.com/owen2345/camaleon-cms/pull/1211","https://github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb#L277-L287","https://gist.github.com/lukmanazri/b7e76a1ddc84dc977800013c53f671b5","https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3","https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.3-path-traversal-rce-via-media-crop-url-action"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-24T11:40:28.810Z"}}},"related_cves":[{"value":"CVE-2026-116009","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dabfd404-8187-44e9-b90c-1cf2f5b7eb5d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116009","advisory_id":"dabfd404-8187-44e9-b90c-1cf2f5b7eb5d","event_types":["advisory"],"published_at":"2026-10-25T16:12:23.19958+00:00","technologies":["camaleon-cms","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T11:40:28.81+00:00","detail_url":"/events/55811"}]}},{"id":12760,"cve_ids":["CVE-2026-1776"],"payload":{"kind":"advisory","title":"Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read","summary":"Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.","evidence":"cve:CVE-2026-1776","products":[{"name":{"value":"Camaleon CMS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-1776","aliases":["CVE-2026-1776"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/owen2345/camaleon-cms","vendor":"owen2345","product":"Camaleon CMS","versions":[{"status":"affected","version":"2.4.5.0","versionType":"custom","lessThanOrEqual":"2.9.0"},{"status":"unaffected","version":"f54a77e2a7be601215ea1b396038c589a0cab9af","versionType":"git"}],"packageURL":"pkg:gem/camaleon_cms","packageName":"camaleon-cms","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:22:14.718Z","provider":"cve","references":["https://github.com/owen2345/camaleon-cms/pull/1127","https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af","https://camaleon.website/","https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-1776","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-03-10T14:57:09.790742Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-10T14:57:17.119Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:22:14.718Z"}}},"related_cves":[{"value":"CVE-2026-1776","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fe976403-9275-45d4-898a-4b1580142e2f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-1776","advisory_id":"fe976403-9275-45d4-898a-4b1580142e2f","event_types":["advisory"],"published_at":"2026-10-25T00:12:04.767219+00:00","technologies":["camaleon-cms","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-09T21:08:06.6+00:00","detail_url":"/advisories/advisory%3Afe976403-9275-45d4-898a-4b1580142e2f","group":{"id":"advisory:fe976403-9275-45d4-898a-4b1580142e2f","revision":1,"primary_event_id":12695,"change":"published","superseded_by":[],"changed":{"id":12695,"cve_ids":["CVE-2026-1776"],"payload":{"kind":"advisory","title":"Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read","summary":"Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.","evidence":"cve:CVE-2026-1776","products":[{"name":{"value":"Camaleon CMS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-1776","aliases":["CVE-2026-1776"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/owen2345/camaleon-cms","vendor":"owen2345","product":"Camaleon CMS","versions":[{"status":"affected","version":"2.4.5.0","versionType":"custom","lessThanOrEqual":"2.9.0"},{"status":"unaffected","version":"f54a77e2a7be601215ea1b396038c589a0cab9af","versionType":"git"}],"packageURL":"pkg:gem/camaleon_cms","packageName":"camaleon-cms","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:22:14.718Z","provider":"cve","references":["https://github.com/owen2345/camaleon-cms/pull/1127","https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af","https://camaleon.website/","https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-1776","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-03-10T14:57:09.790742Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-10T14:57:17.119Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:22:14.718Z"}}},"related_cves":[{"value":"CVE-2026-1776","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fe976403-9275-45d4-898a-4b1580142e2f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-1776","advisory_id":"fe976403-9275-45d4-898a-4b1580142e2f","event_types":["advisory"],"published_at":"2026-10-25T00:12:04.767219+00:00","technologies":["camaleon-cms","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-09T21:08:06.6+00:00","detail_url":"/events/12695"},"members":[{"id":12695,"cve_ids":["CVE-2026-1776"],"payload":{"kind":"advisory","title":"Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read","summary":"Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.","evidence":"cve:CVE-2026-1776","products":[{"name":{"value":"Camaleon CMS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-1776","aliases":["CVE-2026-1776"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/owen2345/camaleon-cms","vendor":"owen2345","product":"Camaleon CMS","versions":[{"status":"affected","version":"2.4.5.0","versionType":"custom","lessThanOrEqual":"2.9.0"},{"status":"unaffected","version":"f54a77e2a7be601215ea1b396038c589a0cab9af","versionType":"git"}],"packageURL":"pkg:gem/camaleon_cms","packageName":"camaleon-cms","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:22:14.718Z","provider":"cve","references":["https://github.com/owen2345/camaleon-cms/pull/1127","https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af","https://camaleon.website/","https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-1776","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-03-10T14:57:09.790742Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-10T14:57:17.119Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:22:14.718Z"}}},"related_cves":[{"value":"CVE-2026-1776","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fe976403-9275-45d4-898a-4b1580142e2f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-1776","advisory_id":"fe976403-9275-45d4-898a-4b1580142e2f","event_types":["advisory"],"published_at":"2026-10-25T00:12:04.767219+00:00","technologies":["camaleon-cms","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-09T21:08:06.6+00:00","detail_url":"/events/12695"}]}},{"id":3406,"cve_ids":["CVE-2026-102261"],"payload":{"kind":"advisory","title":"owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization","summary":"A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.","evidence":"cve:CVE-2026-102261","products":[{"name":{"value":"Camaleon CMS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102261","aliases":["CVE-2026-102261"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:owen2345:camaleon_cms:*:*:*:*:*:*:*:*"],"vendor":"owen2345","modules":["Media Crop Handler"],"product":"Camaleon CMS","versions":[{"status":"affected","version":"2.9.0"},{"status":"affected","version":"2.9.1"},{"status":"affected","version":"2.9.2"},{"status":"unaffected","version":"2.9.3"}]}],"modified":"2026-09-29T10:34:19.407Z","provider":"cve","references":["https://vuldb.com/vuln/411164","https://vuldb.com/vuln/411164/cti","https://vuldb.com/cve/CVE-2026-102261","https://vuldb.com/submit/934944","https://github.com/owen2345/camaleon-cms/commit/c143e145caa600947e70a240e87f2fed889149d3","https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102261","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T10:33:11.159647Z"}}}],"references":[{"url":"https://vuldb.com/submit/934944","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T10:34:19.407Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-29T04:00:13.811Z"}}},"related_cves":[{"value":"CVE-2026-102261","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c0c45045-6c83-4dd9-a90f-6179f3f66c21","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102261","advisory_id":"c0c45045-6c83-4dd9-a90f-6179f3f66c21","event_types":["advisory"],"published_at":"2026-10-24T21:35:23.332406+00:00","technologies":["camaleon-cms","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T04:00:13.811+00:00","detail_url":"/advisories/advisory%3Ac0c45045-6c83-4dd9-a90f-6179f3f66c21","group":{"id":"advisory:c0c45045-6c83-4dd9-a90f-6179f3f66c21","revision":1,"primary_event_id":3424,"change":"published","superseded_by":[],"changed":{"id":3424,"cve_ids":["CVE-2026-102261"],"payload":{"kind":"advisory","title":"owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization","summary":"A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.","evidence":"cve:CVE-2026-102261","products":[{"name":{"value":"Camaleon CMS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102261","aliases":["CVE-2026-102261"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:owen2345:camaleon_cms:*:*:*:*:*:*:*:*"],"vendor":"owen2345","modules":["Media Crop Handler"],"product":"Camaleon CMS","versions":[{"status":"affected","version":"2.9.0"},{"status":"affected","version":"2.9.1"},{"status":"affected","version":"2.9.2"},{"status":"unaffected","version":"2.9.3"}]}],"modified":"2026-09-29T10:34:19.407Z","provider":"cve","references":["https://vuldb.com/vuln/411164","https://vuldb.com/vuln/411164/cti","https://vuldb.com/cve/CVE-2026-102261","https://vuldb.com/submit/934944","https://github.com/owen2345/camaleon-cms/commit/c143e145caa600947e70a240e87f2fed889149d3","https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102261","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T10:33:11.159647Z"}}}],"references":[{"url":"https://vuldb.com/submit/934944","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T10:34:19.407Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-29T04:00:13.811Z"}}},"related_cves":[{"value":"CVE-2026-102261","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c0c45045-6c83-4dd9-a90f-6179f3f66c21","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102261","advisory_id":"c0c45045-6c83-4dd9-a90f-6179f3f66c21","event_types":["advisory"],"published_at":"2026-10-24T21:35:23.332406+00:00","technologies":["camaleon-cms","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T04:00:13.811+00:00","detail_url":"/events/3424"},"members":[{"id":3424,"cve_ids":["CVE-2026-102261"],"payload":{"kind":"advisory","title":"owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization","summary":"A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.","evidence":"cve:CVE-2026-102261","products":[{"name":{"value":"Camaleon CMS","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102261","aliases":["CVE-2026-102261"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:owen2345:camaleon_cms:*:*:*:*:*:*:*:*"],"vendor":"owen2345","modules":["Media Crop Handler"],"product":"Camaleon CMS","versions":[{"status":"affected","version":"2.9.0"},{"status":"affected","version":"2.9.1"},{"status":"affected","version":"2.9.2"},{"status":"unaffected","version":"2.9.3"}]}],"modified":"2026-09-29T10:34:19.407Z","provider":"cve","references":["https://vuldb.com/vuln/411164","https://vuldb.com/vuln/411164/cti","https://vuldb.com/cve/CVE-2026-102261","https://vuldb.com/submit/934944","https://github.com/owen2345/camaleon-cms/commit/c143e145caa600947e70a240e87f2fed889149d3","https://github.com/owen2345/camaleon-cms/releases/tag/2.9.3"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102261","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T10:33:11.159647Z"}}}],"references":[{"url":"https://vuldb.com/submit/934944","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T10:34:19.407Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-29T04:00:13.811Z"}}},"related_cves":[{"value":"CVE-2026-102261","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c0c45045-6c83-4dd9-a90f-6179f3f66c21","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102261","advisory_id":"c0c45045-6c83-4dd9-a90f-6179f3f66c21","event_types":["advisory"],"published_at":"2026-10-24T21:35:23.332406+00:00","technologies":["camaleon-cms","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T04:00:13.811+00:00","detail_url":"/events/3424"}]}}],"next_after":56288,"next_before":3406}