CVE-2026-86100— Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL
Quick assessment
Affected
owen2345 CamaleonCMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Camaleon CMS 从 2.7.5 到 2.9.1 版本在“从 URL 上传”媒体功能中获取远程文件时，未对重定向目标进行有效验证。经过身份验证的攻击者可以构造通过初始验证但随后重定向到内部网络地址的 URL，从而实现对内部服务的服务器端请求伪造（SSRF）。
Possible ATT&CK Techniques 1 AI
T1071 · Application Layer Protocol
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86100
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL
Source: CVE Program / CVE List V5
Vulnerability Description
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| owen2345 | CamaleonCMS | 2.7.5 ~ 2.9.2 | - |
|
II. Public POCs for CVE-2026-86100
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86100
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86100 (2)
Vendor Advisories for CVE-2026-86100 (1)
Vendor Pages for CVE-2026-86100 (1)
Other References for CVE-2026-86100 (1)
IV. Related Vulnerabilities
Same product: CamaleonCMS
-
CVE-2026-73326
CamaleonCMS Missing Authorization via Plugin Administration -
CVE-2026-73332
CamaleonCMS cama_contact_form Plugin Stored XSS via before_h -
CVE-2026-73331
CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug -
CVE-2026-73330
CamaleonCMS 2.9.1 Server-Side Template Injection via test_em -
CVE-2026-73329
CamaleonCMS Stored XSS via Draft Post Title Creation Endpoin
Same vendor: owen2345
-
CVE-2026-73326
CamaleonCMS Missing Authorization via Plugin Administration -
CVE-2026-73332
CamaleonCMS cama_contact_form Plugin Stored XSS via before_h -
CVE-2026-73331
CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug -
CVE-2026-73330
CamaleonCMS 2.9.1 Server-Side Template Injection via test_em -
CVE-2026-73329
CamaleonCMS Stored XSS via Draft Post Title Creation Endpoin
Same weakness: CWE-918
-
CVE-2026-52769
YesWiki: Unauthenticated Server-Side Request Forgery via Act -
CVE-2026-17631
Langflow OSS is affected by server-side request forgery due -
CVE-2026-19301
Langflow is vulnerable to Server-Side Request Forgery due to -
CVE-2026-18905
IBM ContextForge MCP Gateway is affected by server-side requ -
CVE-2026-19304
Langflow is vulnerable to Server-Side Request Forgery due to
V. Comments for CVE-2026-86100
No comments yet