{"id":"CVE-2026-1776","published":"2026-03-09T21:08:06Z","modified":"2026-10-08T15:22:14Z","title":"Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read","vendor":"owen2345","product":"Camaleon CMS","tier":"tail","description":{"text":"Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.","provenance":"source","from":"CVE.org"},"cvss":{"score":6,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00777,"percentile":0.55807,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://github.com/owen2345/camaleon-cms/pull/1127","tags":["issue-tracking"]},{"url":"https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af","tags":["patch"]},{"url":"https://camaleon.website/","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read","tags":["third-party-advisory"]}],"priority":{"score":15.4,"factors":[{"name":"EPSS percentile","points":11.16},{"name":"CVSS severity","points":4.2}]},"vendorSlug":"owen2345","affectedVersions":[{"vendor":"owen2345","product":"Camaleon CMS","versions":[">= 2.4.5.0, <= 2.9.0"]}],"affected":[{"ecosystem":"RubyGems","package":"camaleon_cms","vulnerableRanges":[">=2.4.5.0, <=2.9.1"],"patched":[],"from":["GHSA-jw5g-f64p-6x78"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-10361","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-owen2345-camaleon-cms-cve-2023-30145","parents":[{"from":"CVE-2024-46987","to":"CVE-2026-1776","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.","from":"CVE.org","in":"CVE-2026-1776"}]}]}}