Path traversal in Camaleon CMS - #VU162670
Published: September 18, 2024 / Updated: November 9, 2026
Vulnerability identifier: #VU162670
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an administrator to delete arbitrary files or folders on the server hosting Camaleon CMS, potentially disrupting the CMS or system.
The vulnerability exists due to missing path containment checks in the MediaController deletion action when files are uploaded locally. An administrator can submit a crafted folder parameter containing parent-directory traversal sequences to delete files outside the media directory, as demonstrated by deletion of the application's README.md file.
Affected software
Camaleon CMS
Remediation
Install security update from vendor's website.
Camaleon CMS - update to 2.8.2