Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-1776 Path Traversal in Camaleon CMS AWS S3 Uploader Allowing Unauthorized File Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1776
Post summary
This brief notice announces CVE‑2026‑1776 as a path‑traversal flaw in the Camaleon CMS AWS S3 uploader, but does not provide a PoC, exploit details, or mitigation steps.
CVE-2026-1776 Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authentic… https://www.cve.org/CVERecord?id=CVE-2026-1776
Post summary
The post reports a path traversal vulnerability in Camaleon CMS’s S3 uploader, detailing affected versions and the relevant commit, but does not provide PoC, exploit code, patch info, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tuzitio | camaleon_cms | - | - | - |