Skip to content
OpenAdvisories

Package · RubyGems

camaleon_cms

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.7
    CVE-2024-46987 Public exploit EPSS 15%

    Arbitrary path traversal in Camaleon CMS

    Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CM…

    owen2345 Camaleon CMS camaleon_cms RubyGems
  • High 7.2
    GHSA-7x4w-cj9r-h4v9

    Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)

    The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52) defined inside of the MediaController class do not check whether a given path is inside a cert…

    camaleon_cms RubyGems
  • High 8.8
    CVE-2021-25970

    Camaleon CMS - Insufficient Session Expiration after Password Change

    Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.

    Camaleon CMS Camaleon CMS camaleon_cms RubyGems