CVE-2026-116009: Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the cropurl media action to write an ERB template into a theme's views directory, which executes when rendered.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with only the media permission can exploit it. No additional privileges are described as necessary.
What does an attacker need to do to achieve code execution?
The attacker needs to submit ../ sequences in the name parameter to the crop_url media action and provide a base64 data: URI. This can be used to write an ERB template into a theme views directory, where it executes when rendered.
Which installations are affected?
Camaleon CMS versions before 2.9.3 are affected. The provided information does not state whether any particular default role has the media permission.