Camaleon CMS CVE-2026-116009

Requires an authenticated account that holds the 'media' permission (PR:L) - this is the key access prerequisite and limiting factor, confining exploitation to users already granted media/upload rights rather than anonymous visitors. The concrete trigger is the crop_url media action: the attacker supplies a base64 'data:' URI together with a name parameter containing ../ sequences, which the pre-2.9.3 cama_tmp_upload sink wrote without stripping directory components or verifying the path stayed within tmp_path, letting the base64 payload land as an ERB template inside a theme's views directory. RCE then depends on that written view being rendered. Exploitable against default configurations (no special feature toggle is cited); the only gate is possession of the media permission.

This is a genuinely serious flaw that merits prompt remediation, though not an active-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges (PR:L) - specifically the limited 'media' permission - with full compromise of confidentiality, integrity and availability (VC:H/VI:H/VA:H), consistent with the path-traversal-to-RCE chain in the description. The vuln.today Decision label is 'this_week' (not act_now/emergency). KEV status is NO: there is no indication of active exploitation, so this is targeted prioritization rather than confirmed in-the-wild abuse. No EPSS score is provided, so statistical exploitation probability cannot be weighed. A public PoC reference exists (a GitHub gist plus the VulnCheck advisory, and the vendor's own test spec demonstrates the traversal write); it is not verified as working end-to-end exploit code. Signals are consistent, not conflicting: the main caveat is that exploitation is gated behind an authenticated account holding the media permission (PR:L), which bounds the attacker population to users already granted content-upload rights - a meaningful mitigating factor against purely external unauthenticated attackers.

An attacker holding only the low-privilege media permission sends a crafted request to the crop_url media action containing a base64 data: URI and a name parameter with ../ sequences, causing the server to write an attacker-controlled ERB template into a theme's views directory. When that view is subsequently rendered, the embedded Ruby executes, yielding remote code execution on the host. A public PoC reference exists (gist and VulnCheck advisory) and the fix commit ships a test reproducing the traversal write, though it is not verified as a complete working exploit.