Multiple Vulnerabilities Found in Camaleon CMS Affecting File Uploads
Article Content
- •Two critical vulnerabilities in Camaleon CMS allow unauthorized file access and malicious uploads.
- •The flaws were discovered during the review of an external RCE report against version 2.9.2.
- •Users are urged to apply the fixes from Pull Requests 1201 and 1211 immediately.
Two vulnerabilities have been identified in Camaleon CMS, both affecting file upload functionalities. The first, detailed in Pull Request 1201, addresses a bypass in the arbitrary-file-read fix, allowing unauthorized access to sensitive files via manipulated paths. The second, from Pull Request 1211, permits users with limited permissions to upload potentially malicious content, violating security protocols by retaining rejected uploads. Both issues were discovered during a review of an external remote code execution (RCE) report against version 2.9.2. The vulnerabilities impact all versions of Camaleon CMS up to the latest release, and fixes have been implemented in the respective pull requests. Users are advised to update their installations immediately to mitigate these risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Common questions
Which versions of Camaleon CMS are affected?
What should I do if I'm using Camaleon CMS?
Are these vulnerabilities being actively exploited?
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…