Skip to content
OpenAdvisories
High · 7.7 Public exploit CVE-2024-46987 EUVD-2024-2772GHSA-cp65-5m9r-vc2c

Arbitrary path traversal in Camaleon CMS

Published Sep 18, 2024 · Updated Apr 17, 2025 · Assigned by GitHub_M

Vendor: owen2345 Product: Camaleon CMS Package: camaleon_cms Ecosystem: RubyGems

Description

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

VendorProductAffectedFixed
owen2345 camaleon-cms < 2.8.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 10 repositories

  • Goultarde/CVE-2024-46987 ★ 27 · Feb 1, 2026

    This Python PoC exploits CVE-2024-46987, a Path Traversal bug in Camaleon CMS 2.8.0 < 2.8.2 (work on 2.9.0). It allows authenticated users to read sensitive server files via the MediaController. Inte…

  • advaitpathak21/CVE-2024-46987 ★ 1 · Feb 5, 2026

    Exploit created using Python

  • SuriyaBoon/HackTheBox-Facts ★ 0 · Jun 4, 2026

    HTB Facts is a Easy Linux box featuring Camaleon CMS and MinIO. Gain admin access via open registration and a mass assignment vulnerability, then extract MinIO credentials from admin settings. Use CV…

  • bootstrapbool/msf-cve-2024-46987 ★ 0 · Mar 2, 2026

    Metasploit module to exploit CVE-2024-46987 - an authenticated path traversal vulnerability in Camaleon CMS versions 2.8.0 through 2.8.2 and 2.9.0

  • BLUEBERRYP1LL/CVE-2024-46987 ★ 0 · Feb 22, 2026

    PoC exploit for CVE-2024-46987 — Camaleon CMS arbitrary path traversal (file read)

  • ramzerk/CVE-2024-46987 ★ 0 · Feb 8, 2026

    This Rust PoC exploits CVE-2024-46987, a Path Traversal bug in Camaleon CMS 2.8.0 < 2.8.2 (work on 2.9.0).

  • Rival420/CVE-2024-46987 ★ 0 · Feb 5, 2026

    CVE-2024-46987 - Camaleon CMS LFI Exploit

  • sparrowhawk1113/Exploit-for-CVE-2024-46987 ★ 0 · Feb 5, 2026

    Exploit for CVE-2024-46987

  • Ik0nw/CVE-2024-46987 ★ 0 · Feb 4, 2026
  • L1337Xi/CVE-2024-46987 ★ 0 · Feb 3, 2026

    Path Traversal vulnerability

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems camaleon_cms < 2.8.1 2.8.1 GHSA-cp65-5m9r-vc2c

References