CVE-2024-46987 in the critical feed json
Arbitrary path traversal in Camaleon CMS
published 2024-09-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2772 , GHSA-cp65-5m9r-vc2c
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.6%
- EPSS 14.6% chance of exploitation in 30 days, percentile 96%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- rubygems camaleon_cms 2.8.1
- tuzitio camaleon_cms 2.8.2
Timeline
- First public exploit (Metasploit auxiliary/gather/camaleon_download_private_file)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
14.56% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/gather/camaleon_download_private_file Camaleon CMS Directory Traversal CVE-2024-46987 metasploit auxiliary, normal rank, 2024-08-08
- EDB-52531 Camaleon CMS v2.9.0 - Path Traversal webapps, 2026-04-30
- github.com https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | camaleon_cms | <2.8.1 |
2.8.1 |
Affected products
- owen2345 camaleon-cms
- tuzitio camaleon_cms
Classification
References
-
reddit.com
/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released
web, patch
-
github.com
/owen2345/camaleon-cms/commit/071b1b09d6d61ab02a5960b1ccafd9d9c2155a3e
web
-
github.com
/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c
web, exploit, third-party-advisory
-
codeql.github.com
/codeql-query-help/ruby/rb-path-injection
web, third-party-advisory
-
owasp.org
/www-community/attacks/Path_Traversal
web, issue-tracking
-
securitylab.github.com
/advisories/GHSL-2024-182_GHSL-2024-186_Camaleon_CMS
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-46987
advisory
-
github.com
/owen2345/camaleon-cms
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2024-46987.yml
web
Sources
- CVE List CVE-2024-46987
- GitHub Advisory GHSA-cp65-5m9r-vc2c
- NVD CVE-2024-46987
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.