CVE-2026-116009— Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
Quick assessment
Affected
owen2345 camaleon-cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Camaleon CMS 2.9.3 之前的版本存在路径遍历漏洞。仅拥有媒体权限的用户可通过在 参数中提供 序列，写入任意文件。攻击者可向 媒体操作发送 base64 编码的 URI，从而将 ERB 模板写入主题的 目录；该模板在渲染时将被执行。
Possible ATT&CK Techniques 2 AI
T1552.001 · Credentials In Files T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-116009
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
Source: CVE Program / CVE List V5
Vulnerability Description
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| owen2345 | camaleon-cms | 0 ~ 2.9.3 | - |
|
II. Public POCs for CVE-2026-116009
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-116009
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-116009 (3)
Vendor Advisories for CVE-2026-116009 (1)
Proof of Concept for CVE-2026-116009 (1)
Other References for CVE-2026-116009 (2)
IV. Related Vulnerabilities
Same product: camaleon-cms
-
CVE-2026-67616
Camaleon CMS 2.9.2 Missing Authorization via /admin/post_typ -
CVE-2026-66748
Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval -
CVE-2025-2304
Camaleon CMS Privilege Escalation -
CVE-2024-46987
Arbitrary path traversal in Camaleon CMS -
CVE-2024-46986
Arbitrary file write leading to RCE in Camaleon CMS
Same vendor: owen2345
-
CVE-2026-102261
owen2345 Camaleon CMS Media Crop media_controller.rb crop au -
CVE-2026-86100
Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in U -
CVE-2026-73326
CamaleonCMS Missing Authorization via Plugin Administration -
CVE-2026-73332
CamaleonCMS cama_contact_form Plugin Stored XSS via before_h -
CVE-2026-73331
CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug
Same weakness: CWE-22
-
CVE-2026-115932
Path traversal in post media lets any registered user read s -
CVE-2026-115800
UbiquitousLearning mllm Convertor __init__.py load_model pat -
CVE-2026-115569
Fallow: Jest and Vitest `projects` entries let an analyzed r -
CVE-2026-46652
Path traversal via HTTP `Content-Disposition` header in Exte -
CVE-2026-114623
baserCMS: Path traversal in the BcThemeFile admin screen all
V. Comments for CVE-2026-116009
No comments yet