Skip to content
OpenAdvisories
Medium · 5.4 Public exploit CVE-2026-102261 EUVD-2026-88630GHSA-fgph-j4q2-h2m4

owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization

Published Sep 29, 2026 · Updated Sep 29, 2026 · Assigned by VulDB

Vendor: owen2345 Product: Camaleon CMS

Description

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.

Affected products

VendorProductAffectedFixed
owen2345 Camaleon CMS 2.9.0, 2.9.1, 2.9.2 2.9.3

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References