{"id":"CVE-2024-46987","aliases":["EUVD-2024-2772","GHSA-cp65-5m9r-vc2c"],"status":"published","title":"Arbitrary path traversal in Camaleon CMS","description":"Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.1456,"percentile":0.9669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200","CWE-22"],"published":"2024-09-18T15:46:53Z","modified":"2026-10-28T02:31:13Z","exploits":[{"source":"exploitdb","id":"EDB-52531","title":"Camaleon CMS  v2.9.0 - Path Traversal","type":"webapps","platform":"multiple","date":"2026-04-30","url":"https://www.exploit-db.com/exploits/52531"},{"source":"metasploit","id":"auxiliary/gather/camaleon_download_private_file","title":"Camaleon CMS Directory Traversal CVE-2024-46987","type":"auxiliary","platform":"Linux","date":"2024-08-08","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/camaleon_download_private_file"},{"source":"pocgithub","id":"BLUEBERRYP1LL/CVE-2024-46987","title":"BLUEBERRYP1LL/CVE-2024-46987","date":"2026-02-22","url":"https://github.com/BLUEBERRYP1LL/CVE-2024-46987"},{"source":"pocgithub","id":"Goultarde/CVE-2024-46987","title":"Goultarde/CVE-2024-46987","date":"2026-02-01","url":"https://github.com/Goultarde/CVE-2024-46987"},{"source":"pocgithub","id":"Ik0nw/CVE-2024-46987","title":"Ik0nw/CVE-2024-46987","date":"2026-02-04","url":"https://github.com/Ik0nw/CVE-2024-46987"},{"source":"pocgithub","id":"L1337Xi/CVE-2024-46987","title":"L1337Xi/CVE-2024-46987","date":"2026-02-03","url":"https://github.com/L1337Xi/CVE-2024-46987"},{"source":"pocgithub","id":"Rival420/CVE-2024-46987","title":"Rival420/CVE-2024-46987","date":"2026-02-05","url":"https://github.com/Rival420/CVE-2024-46987"},{"source":"pocgithub","id":"SuriyaBoon/HackTheBox-Facts","title":"SuriyaBoon/HackTheBox-Facts","date":"2026-06-04","url":"https://github.com/SuriyaBoon/HackTheBox-Facts"},{"source":"pocgithub","id":"advaitpathak21/CVE-2024-46987","title":"advaitpathak21/CVE-2024-46987","date":"2026-02-05","url":"https://github.com/advaitpathak21/CVE-2024-46987"},{"source":"pocgithub","id":"bootstrapbool/msf-cve-2024-46987","title":"bootstrapbool/msf-cve-2024-46987","date":"2026-03-02","url":"https://github.com/bootstrapbool/msf-cve-2024-46987"},{"source":"pocgithub","id":"ramzerk/CVE-2024-46987","title":"ramzerk/CVE-2024-46987","date":"2026-02-08","url":"https://github.com/ramzerk/CVE-2024-46987"},{"source":"pocgithub","id":"sparrowhawk1113/Exploit-for-CVE-2024-46987","title":"sparrowhawk1113/Exploit-for-CVE-2024-46987","date":"2026-02-05","url":"https://github.com/sparrowhawk1113/Exploit-for-CVE-2024-46987"}],"fixes":[{"ecosystem":"RubyGems","package":"camaleon_cms","fixed_in":["2.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"camaleon_cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"camaleon_cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1"}]}],"versions":["0.0.1","0.0.2","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","1.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.4.1","2.1.0","2.1.1","2.1.1.4","2.1.2.0","2.1.2.1","2.2.0","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.7.1","2.3.7.2","2.4.0","2.4.1","2.4.2","2.4.3","2.4.3.1","2.4.3.10","2.4.3.11","2.4.3.12","2.4.3.13","2.4.3.2","2.4.3.3","2.4.3.4","2.4.3.5","2.4.3.6","2.4.3.7","2.4.3.8","2.4.3.9","2.4.4","2.4.4.1","2.4.4.2","2.4.4.3","2.4.4.4","2.4.4.5","2.4.4.6","2.4.4.7","2.4.5","2.4.5.1","2.4.5.10","2.4.5.11","2.4.5.12","2.4.5.13","2.4.5.14","2.4.5.2","2.4.5.3","2.4.5.4","2.4.5.5","2.4.5.7","2.4.5.8","2.4.5.9","2.4.6.0","2.4.6.1","2.4.6.2","2.4.6.3","2.4.6.4","2.4.6.5","2.4.6.6","2.4.6.7","2.4.6.8","2.4.6.9","2.5.0","2.5.1","2.5.2","2.5.3","2.5.3.1","2.6.0","2.6.0.1","2.6.1","2.6.2","2.6.3","2.6.4","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.8.0"]}],"products":[{"vendor":"owen2345","product":"camaleon-cms"},{"vendor":"tuzitio","product":"camaleon_cms"}],"references":[{"url":"https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c","tags":["x_refsource_CONFIRM","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://codeql.github.com/codeql-query-help/ruby/rb-path-injection","tags":["x_refsource_MISC","Third Party Advisory","web"]},{"url":"https://owasp.org/www-community/attacks/Path_Traversal","tags":["x_refsource_MISC","Issue Tracking","web"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-182_GHSL-2024-186_Camaleon_CMS","tags":["x_refsource_MISC","advisory"]},{"url":"https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released","tags":["x_refsource_MISC","Patch","web"]},{"url":"https://github.com/owen2345/camaleon-cms/commit/071b1b09d6d61ab02a5960b1ccafd9d9c2155a3e","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46987","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2024-46987.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cp65-5m9r-vc2c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46987.json","tags":["advisory"]},{"url":"https://github.com/owen2345/camaleon-cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-46987","title":"Arbitrary path traversal in Camaleon CMS","description":"Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-09-18T17:15:45.829Z","modified":"2025-04-17T18:07:30.718Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T14:34:08.500935Z"}],"euvd":[{"id":"EUVD-2024-2772","description":"Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-09-18T17:15:45Z","modified":"2025-04-17T18:07:30Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:21.05399Z"}],"ghsa":[{"id":"GHSA-cp65-5m9r-vc2c","title":"Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)","description":"A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions).\n\nIn the [download_private_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L28) method:\n```ruby\ndef download_private_file\n  cama_uploader.enable_private_mode!\n\n  file = cama_uploader.fetch_file(\"private/#{params[:file]}\")\n\n  send_file file, disposition: 'inline'\nend\n```\nThe file parameter is passed to the [fetch_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_local_uploader.rb#L27) method of the CamaleonCmsLocalUploader class (when files are uploaded locally):\n```ruby\ndef fetch_file(file_name)\n  raise ActionController::RoutingError, 'File not found' unless file_exists?(file_name)\n\n  file_name\nend\n```\nIf the file exists it's passed back to the download_private_file method where the file is sent to the user via [send_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L33-L34).\n\nProof of concept\nAn authenticated user can download the /etc/passwd file by visiting an URL such as:\n\nhttps://\u003ccamaleon-host\u003e/admin/media/download_private_file?file=../../../../../../etc/passwd\nImpact\nThis issue may lead to Information Disclosure.\n\nRemediation\nNormalize file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.\n\nSee also:\n\n[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)\n[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)","status":"published","published":"2024-09-18T15:46:53Z","modified":"2025-04-17T23:00:54Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:38:40.628275Z"}],"nvd":[{"id":"CVE-2024-46987","description":"Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-09-18T18:15:07.44Z","modified":"2026-06-17T07:56:19.257Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:10:27.456509Z"}],"osv":[{"id":"CVE-2024-46987","title":"Arbitrary path traversal in Camaleon CMS","description":"Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-09-18T17:15:45.829Z","modified":"2026-10-28T02:31:13.985381599Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"GHSA-cp65-5m9r-vc2c","title":"Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)","description":"A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions).\n\nIn the [download_private_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L28) method:\n```ruby\ndef download_private_file\n  cama_uploader.enable_private_mode!\n\n  file = cama_uploader.fetch_file(\"private/#{params[:file]}\")\n\n  send_file file, disposition: 'inline'\nend\n```\nThe file parameter is passed to the [fetch_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_local_uploader.rb#L27) method of the CamaleonCmsLocalUploader class (when files are uploaded locally):\n```ruby\ndef fetch_file(file_name)\n  raise ActionController::RoutingError, 'File not found' unless file_exists?(file_name)\n\n  file_name\nend\n```\nIf the file exists it's passed back to the download_private_file method where the file is sent to the user via [send_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L33-L34).\n\nProof of concept\nAn authenticated user can download the /etc/passwd file by visiting an URL such as:\n\nhttps://\u003ccamaleon-host\u003e/admin/media/download_private_file?file=../../../../../../etc/passwd\nImpact\nThis issue may lead to Information Disclosure.\n\nRemediation\nNormalize file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.\n\nSee also:\n\n[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)\n[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)","status":"published","published":"2024-09-18T15:46:53Z","modified":"2025-04-17T23:23:18.562873Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:46:45.28161Z"}]}}