camaleon-cms vulnerabilities

CVEs whose affected-version data names the camaleon-cms package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-116009High· 8.8

today

Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action

Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the cr…

▾ Twilightowen2345 · camaleon-cmsvia CVEORG