CVE-2026-1776 Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read
Authenticated users can read arbitrary files via path traversal in the AWS S3 uploader, exposing sensitive server data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-1776?
CVE-2026-1776 is a medium-severity path traversal vulnerability in owen2345 Camaleon CMS, published on 9 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.
Weakness: CWE-22
Which versions are affected by CVE-2026-1776?
2 open source packages ship an affected version, including camaleon_cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
camaleon_cms RubyGems | From 2.4.5.0 to 2.9.1 | None |
camaleon_cms RubyGems | From 2.4.5.0 to 2.9.1 | None |
Products include Tuzitio Camaleon Cms.
How do I fix CVE-2026-1776?
No fix has been published for CVE-2026-1776 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-1776 being exploited?
There is no known exploitation of CVE-2026-1776 in the wild and no public exploit code.
Other vulnerabilities in owen2345 Camaleon CMS
- CVE-2024-46986 Arbitrary file write leading to RCE in Camaleon CMS
- CVE-2023-30145 Server-Side Template Injection in Camaleon CMS
- CVE-2021-25970 Camaleon CMS - Insufficient Session Expiration after Password Change
- CVE-2024-46987 Arbitrary path traversal in Camaleon CMS
- CVE-2021-25969 Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments
Sources
Also known as GHSA-jw5g-f64p-6x78.