CVE-2026-1776

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-1776
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://camaleon.website/ Product
https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af Patch
https://github.com/owen2345/camaleon-cms/pull/1127 Issue Tracking Patch
https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*
History

17 Apr 2026, 20:59

Type Values Removed Values Added
First Time Tuzitio
Tuzitio camaleon Cms
CPE cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
Summary
  • (es) Las versiones 2.4.5.0 a 2.9.0 de Camaleon CMS, anteriores al commit f54a77e, contienen una vulnerabilidad de salto de ruta en la implementación del cargador de AWS S3 que permite a los usuarios autenticados leer archivos arbitrarios del sistema de archivos del servidor web. El problema ocurre en la funcionalidad download_private_file cuando la aplicación está configurada para usar el backend CamaleonCmsAwsUploader. A diferencia de la implementación del cargador local, el cargador de AWS no valida las rutas de archivo con valid_folder_path?, permitiendo que se suministren secuencias de salto de directorio a través del parámetro file. Como resultado, cualquier usuario autenticado, incluidos los usuarios registrados con pocos privilegios, puede acceder a archivos sensibles como /etc /passwd. Este problema representa una omisión de la corrección incompleta para CVE-2024-46987 y afecta a las implementaciones que utilizan el backend de almacenamiento de AWS S3.
References () https://camaleon.website/ - () https://camaleon.website/ - Product
References () https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af - () https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af - Patch
References () https://github.com/owen2345/camaleon-cms/pull/1127 - () https://github.com/owen2345/camaleon-cms/pull/1127 - Issue Tracking, Patch
References () https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read - () https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read - Patch, Third Party Advisory

10 Mar 2026, 07:38

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 07:38

Updated : 2026-04-17 20:59

NVD link : CVE-2026-1776

Mitre link : CVE-2026-1776

CVE.ORG link : CVE-2026-1776

JSON object : View

Products Affected

tuzitio

  • camaleon_cms
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')