Camaleon Cms
Monthly
Camaleon CMS releases before 2.9.2 enforce only authentication, not authorization, on the Admin::MediaController endpoints that handle uploads, private file downloads, cropping and media actions, letting any logged-in user whose role lacks the media manager permission reach those functions by direct URL or POST. A low-privileged authenticated attacker can therefore store files via /admin/media/upload, read private media through download_private_file, and use crop with saved_avatar to alter other users' avatars, producing a high confidentiality impact with limited integrity impact. The vendor has released 2.9.2 with a centralized before_action check, so no public exploit code or active exploitation is indicated in the available data; the CVSS 4.0 base score is 7.1 and priority is this_week, reflecting a real but not emergency-grade issue given the authenticated-account prerequisite.
Camaleon CMS releases before 2.9.3 let an authenticated user who holds only the 'media' permission escape the site's temporary upload directory and write arbitrary files, which can be escalated to remote code execution. The concrete route is the crop_url media action: the attacker submits a base64 'data:' URI together with a name parameter containing ../ sequences, and the pre-2.9.3 upload sink stores the decoded payload at the traversed path - including an ERB template placed inside a theme's views directory, which executes when that view is rendered. The only gate is possession of the media permission, which confines the issue to users already granted upload rights rather than anonymous visitors; the vendor has shipped a fix in 2.9.3 and no public exploit has been identified at time of analysis, though the flaw warrants prompt remediation this week.
Authenticated remote code execution in Camaleon CMS 2.1.1 through 2.9.1 lets users who hold the custom_fields manage permission store an arbitrary Ruby expression in the 'command' option of a select_eval custom field, which is then evaluated via instance_eval inside an ERB view whenever a post edit page is rendered, yielding code execution with web-server process privileges. Publicly available exploit code exists (including a public proof-of-concept repository and writeup), but the flaw is not listed in CISA KEV and EPSS is modest at 0.74% (51st percentile), so practical risk concentrates on installations that delegate custom-field management to non-administrative roles. The vulnerability requires an authenticated principal with that permission (CVSS vector PR:L), and is not reachable by anonymous users.
Category-management authorization bypass in Camaleon CMS before 2.9.2 lets an authenticated low-privileged user rename or delete categories belonging to a different post type by pairing their own authorized post_type_id with an arbitrary category ID in update or destroy requests. The flaw is an insecure direct object reference (CWE-639) in Admin::CategoriesController with medium severity impact limited to integrity and availability of category objects; it does not disclose data or enable code execution. Vendor-released patch 2.9.2 is available, and no public exploit code was identified at time of analysis.
Object-level authorization bypass in owen2345 Camaleon CMS through 2.9.2 lets an authenticated user who holds only the media-library permission (`:manage, :media`) overwrite another user's avatar by calling the admin media crop endpoint with the `saved_avatar` parameter set to a victim's user ID. The crop action reaches the same avatar meta write that `UsersController#update` protects with `:manage, :users`, but enforces only the media permission, so the media library becomes a side door into profile editing; post-PR-#1267 the target is scoped to `current_site.users`, limiting the bypass to same-site, cross-user writes rather than cross-tenant ones. Publicly available exploit code exists (CVSS 4.0 vector carries E:P), and the vendor has released a fix in 2.9.3; the exposure is limited to profile-meta tampering with no access to passwords, credentials, or confidential data, so the assessed risk is genuinely low. No confirmed active exploitation (CISA KEV) was identified at time of analysis.
Draft post creation in Camaleon CMS through 2.9.2 allows any authenticated low-privileged user to create and overwrite draft posts by bypassing role and permission checks on the admin drafts endpoint. The DraftsController's overridden create and update actions omitted the authorize! calls enforced by the parent PostsController, and used global unscoped post lookups that ignore post type and user ownership, enabling cross-post-type draft manipulation and ownership attribution changes on existing drafts. No CISA KEV listing or public exploit code has been identified; the CVSS 4.0 score of 5.3 (PR:L, VI:L) reflects limited integrity impact with no confidentiality or availability consequence.
Improper authorization in Camaleon CMS 2.9.2 allows any low-privileged authenticated user to overwrite draft content belonging to other users by supplying an arbitrary post_id to the administrator draft autosave endpoint. The application authenticates the requesting user but performs no ownership check, meaning a contributor or editor can silently corrupt unpublished drafts they do not own. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem.
Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Camaleon CMS releases before 2.9.2 enforce only authentication, not authorization, on the Admin::MediaController endpoints that handle uploads, private file downloads, cropping and media actions, letting any logged-in user whose role lacks the media manager permission reach those functions by direct URL or POST. A low-privileged authenticated attacker can therefore store files via /admin/media/upload, read private media through download_private_file, and use crop with saved_avatar to alter other users' avatars, producing a high confidentiality impact with limited integrity impact. The vendor has released 2.9.2 with a centralized before_action check, so no public exploit code or active exploitation is indicated in the available data; the CVSS 4.0 base score is 7.1 and priority is this_week, reflecting a real but not emergency-grade issue given the authenticated-account prerequisite.
Camaleon CMS releases before 2.9.3 let an authenticated user who holds only the 'media' permission escape the site's temporary upload directory and write arbitrary files, which can be escalated to remote code execution. The concrete route is the crop_url media action: the attacker submits a base64 'data:' URI together with a name parameter containing ../ sequences, and the pre-2.9.3 upload sink stores the decoded payload at the traversed path - including an ERB template placed inside a theme's views directory, which executes when that view is rendered. The only gate is possession of the media permission, which confines the issue to users already granted upload rights rather than anonymous visitors; the vendor has shipped a fix in 2.9.3 and no public exploit has been identified at time of analysis, though the flaw warrants prompt remediation this week.
Authenticated remote code execution in Camaleon CMS 2.1.1 through 2.9.1 lets users who hold the custom_fields manage permission store an arbitrary Ruby expression in the 'command' option of a select_eval custom field, which is then evaluated via instance_eval inside an ERB view whenever a post edit page is rendered, yielding code execution with web-server process privileges. Publicly available exploit code exists (including a public proof-of-concept repository and writeup), but the flaw is not listed in CISA KEV and EPSS is modest at 0.74% (51st percentile), so practical risk concentrates on installations that delegate custom-field management to non-administrative roles. The vulnerability requires an authenticated principal with that permission (CVSS vector PR:L), and is not reachable by anonymous users.
Category-management authorization bypass in Camaleon CMS before 2.9.2 lets an authenticated low-privileged user rename or delete categories belonging to a different post type by pairing their own authorized post_type_id with an arbitrary category ID in update or destroy requests. The flaw is an insecure direct object reference (CWE-639) in Admin::CategoriesController with medium severity impact limited to integrity and availability of category objects; it does not disclose data or enable code execution. Vendor-released patch 2.9.2 is available, and no public exploit code was identified at time of analysis.
Object-level authorization bypass in owen2345 Camaleon CMS through 2.9.2 lets an authenticated user who holds only the media-library permission (`:manage, :media`) overwrite another user's avatar by calling the admin media crop endpoint with the `saved_avatar` parameter set to a victim's user ID. The crop action reaches the same avatar meta write that `UsersController#update` protects with `:manage, :users`, but enforces only the media permission, so the media library becomes a side door into profile editing; post-PR-#1267 the target is scoped to `current_site.users`, limiting the bypass to same-site, cross-user writes rather than cross-tenant ones. Publicly available exploit code exists (CVSS 4.0 vector carries E:P), and the vendor has released a fix in 2.9.3; the exposure is limited to profile-meta tampering with no access to passwords, credentials, or confidential data, so the assessed risk is genuinely low. No confirmed active exploitation (CISA KEV) was identified at time of analysis.
Draft post creation in Camaleon CMS through 2.9.2 allows any authenticated low-privileged user to create and overwrite draft posts by bypassing role and permission checks on the admin drafts endpoint. The DraftsController's overridden create and update actions omitted the authorize! calls enforced by the parent PostsController, and used global unscoped post lookups that ignore post type and user ownership, enabling cross-post-type draft manipulation and ownership attribution changes on existing drafts. No CISA KEV listing or public exploit code has been identified; the CVSS 4.0 score of 5.3 (PR:L, VI:L) reflects limited integrity impact with no confidentiality or availability consequence.
Improper authorization in Camaleon CMS 2.9.2 allows any low-privileged authenticated user to overwrite draft content belonging to other users by supplying an arbitrary post_id to the administrator draft autosave endpoint. The application authenticates the requesting user but performs no ownership check, meaning a contributor or editor can silently corrupt unpublished drafts they do not own. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem.
Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.