Camaleon CMS CVE-2026-86100

Requires a valid authenticated session on the Camaleon CMS instance-CVSS PR:L confirms a low-privilege account is sufficient, with no admin role required. The attacker must control an HTTP server capable of issuing redirect responses. The 'Upload from URL' feature must be accessible to the authenticated user's role. Impact is substantially elevated when the CMS application server has unfiltered egress to cloud instance metadata services (AWS IMDSv1 at 169.254.169.254, GCP metadata at 169.254.169.254 or metadata.google.internal) or unauthenticated internal HTTP APIs; in environments with egress filtering that blocks RFC-1918 and link-local ranges, the reachable internal attack surface is greatly reduced. Unauthenticated exploitation is not possible.

The CVSS 4.0 score of 5.3 with AV:N/AC:L/AT:N/PR:L/UI:N reflects moderate risk: network-accessible and low complexity, but gated behind a valid authenticated session. Real-world impact is environment-dependent: cloud-hosted deployments with access to IMDSv1 metadata endpoints face a meaningfully higher threat because a successful SSRF could return IAM role credentials without further authentication, whereas on-premises deployments with egress filtering blocking RFC-1918 ranges have substantially reduced exposure. No EPSS data was provided in available intelligence. No active exploitation has been confirmed-no CISA KEV listing and no public POC have been identified at time of analysis. The CVSS subsequent-system metrics (SC:L/SI:L in the provided 4.0 vector) correctly capture that downstream internal services are the primary victims, not the CMS itself; the vendor's VI:L claim is assessed as overstated for what is a read-only SSRF path.

An authenticated CMS user with media library access submits a URL pointing to an attacker-controlled HTTP server via the 'Upload from URL' feature. The attacker's server responds with an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/, and the pre-patch CMS follows the redirect transparently, fetching and potentially storing or returning IAM role credentials to the attacker. No public POC has been identified, but the technique is well-documented for OpenURI-based SSRF patterns in Ruby web applications.