CVE-2024-46987

Arbitrary path traversal in Camaleon CMS

7.7 HighPublic exploitFix available

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

14.6%Up 14.5 points since Sep 19, 2024

What each source reports

CVE List Score used 7.7

Arbitrary path traversal in Camaleon CMS

Record: CVE-2024-46987
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-200, CWE-22
Updated: 2026-11-02

EUVDEUVD-2024-2772 7.7

Record: EUVD-2024-2772
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cp65-5m9r-vc2c 7.1

Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)

A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions).

In the download_private_file method:

def download_private_file
  cama_uploader.enable_private_mode!

  file = cama_uploader.fetch_file("private/#{params[:file]}")

  send_file file, disposition: 'inline'
end

The file parameter is passed to the fetch_file method of the CamaleonCmsLocalUploader class (when files are uploaded locally):

def fetch_file(file_name)
  raise ActionController::RoutingError, 'File not found' unless file_exists?(file_name)

  file_name
end

If the file exists it's passed back to the download_private_file method where the file is sent to the user via send_file.

Proof of concept An authenticated user can download the /etc/passwd file by visiting an URL such as:

https://<camaleon-host>/admin/media/download_private_file?file=../../../../../../etc/passwd Impact This issue may lead to Information Disclosure.

Remediation Normalize file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.

Record: GHSA-cp65-5m9r-vc2c
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22, CWE-200
Updated: 2026-11-02

NVD 7.7

Record: CVE-2024-46987
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-22, CWE-200
Updated: 2026-11-02

OSV 7.7

Arbitrary path traversal in Camaleon CMS

Record: CVE-2024-46987
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-200, CWE-22
Updated: 2026-11-02

OSVGHSA-cp65-5m9r-vc2c 7.1

Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)

In the download_private_file method:

def download_private_file
  cama_uploader.enable_private_mode!

  file = cama_uploader.fetch_file("private/#{params[:file]}")

  send_file file, disposition: 'inline'
end

The file parameter is passed to the fetch_file method of the CamaleonCmsLocalUploader class (when files are uploaded locally):

def fetch_file(file_name)
  raise ActionController::RoutingError, 'File not found' unless file_exists?(file_name)

  file_name
end

If the file exists it's passed back to the download_private_file method where the file is sent to the user via send_file.

Proof of concept An authenticated user can download the /etc/passwd file by visiting an URL such as:

https://<camaleon-host>/admin/media/download_private_file?file=../../../../../../etc/passwd Impact This issue may lead to Information Disclosure.

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`camaleon_cms` RubyGems	before 2.8.1	2.8.1
`camaleon_cms` RubyGems	before 2.8.1, plus listed versions 0.0.10.0.20.1.20.1.30.1.4 Show 45 moreShow less 0.1.50.1.60.1.70.1.80.1.90.2.00.2.11.01.0.11.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.02.0.12.0.22.0.32.0.42.0.4.12.1.02.1.12.1.1.42.1.2.02.1.2.12.2.02.2.12.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.7.12.3.7.22.4.02.4.12.4.22.4.32.4.3.1	2.8.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Camaleon CMS v2.9.0 - Path Traversal	2026-04-30
Metasploit	Camaleon CMS Directory Traversal CVE-2024-46987	2024-08-08
PoC in GitHub	BLUEBERRYP1LL/CVE-2024-46987	2026-02-22
PoC in GitHub	Goultarde/CVE-2024-46987	2026-02-01
PoC in GitHub	Ik0nw/CVE-2024-46987	2026-02-04
PoC in GitHub	L1337Xi/CVE-2024-46987	2026-02-03
PoC in GitHub	Rival420/CVE-2024-46987	2026-02-05
PoC in GitHub	SuriyaBoon/HackTheBox-Facts	2026-06-04
PoC in GitHub	advaitpathak21/CVE-2024-46987	2026-02-05
PoC in GitHub	bootstrapbool/msf-cve-2024-46987	2026-03-02
PoC in GitHub	ramzerk/CVE-2024-46987	2026-02-08
PoC in GitHub	sparrowhawk1113/Exploit-for-CVE-2024-46987	2026-02-05

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-46987 is a high vulnerability (CVSS 7.7) in Tuzitio Camaleon Cms, published September 18, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.6%, the 96th percentile. Fixed in camaleon_cms 2.8.1.

References

Show 5 moreShow less

This page doesn't list everything

Left out here: 62 versions. The JSON record has them.