CVE-2021-25971
Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
- Record
CVE-2021-25971- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-248
- Updated
- 2026-11-02
EUVDEUVD-2022-5071
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
- Record
EUVD-2022-5071- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r2w2-h6r8-3r53
Camaleon CMS vulnerable to Uncaught Exception
In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file.
- Record
GHSA-r2w2-h6r8-3r53- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-248
- Updated
- 2026-11-02
NVD
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
- Record
CVE-2021-25971- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-248, CWE-755
- Updated
- 2026-11-02
OSV
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
- Record
CVE-2021-25971- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-r2w2-h6r8-3r53
Camaleon CMS vulnerable to Uncaught Exception
In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file.
- Record
GHSA-r2w2-h6r8-3r53- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-248
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
camaleon_cmsRubyGems |
2.0.1 up to 2.6.0.1 | 2.6.0.1 |
camaleon_cmsRubyGems |
2.0.1 up to 2.6.0.1, plus listed versions 2.0.22.0.32.0.42.0.4.12.1.0 Show 45 moreShow less2.1.12.1.1.42.1.2.02.1.2.12.2.02.2.12.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.7.12.3.7.22.4.02.4.12.4.22.4.32.4.3.12.4.3.102.4.3.112.4.3.122.4.3.132.4.3.22.4.3.32.4.3.42.4.3.52.4.3.62.4.3.72.4.3.82.4.3.92.4.42.4.4.12.4.4.22.4.4.32.4.4.42.4.4.52.4.4.62.4.4.72.4.52.4.5.12.4.5.102.4.5.11 |
2.6.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-25971 is a medium vulnerability (CVSS 4.3) in Camaleon Cms Cms, published October 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in camaleon_cms 2.6.0.1.
References
github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2
whitesourcesoftware.com/vulnerability-database/CVE-2021-25971
nvd.nist.gov/vuln/detail/CVE-2021-25971
Left out here: 26 versions. The JSON record has them.