Advisory details:
github_osv / GHSA-cp65-5m9r-vc2c
| Advisory ID | github_osv/GHSA-cp65-5m9r-vc2c |
| Aliases |
CVE-2024-46987
|
| Summary | Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183) A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). In the [download_private_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L28) method: ```ruby def download_private_file cama_uploader.enable_private_mode! file = cama_uploader.fetch_file("private/#{params[:file]}") send_file file, disposition: 'inline' end ``` The file parameter is passed to the [fetch_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_local_uploader.rb#L27) method of the CamaleonCmsLocalUploader class (when files are uploaded locally): ```ruby def fetch_file(file_name) raise ActionController::RoutingError, 'File not found' unless file_exists?(file_name) file_name end ``` If the file exists it's passed back to the download_private_file method where the file is sent to the user via [send_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L33-L34). Proof of concept An authenticated user can download the /etc/passwd file by visiting an URL such as: https://<camaleon-host>/admin/media/download_private_file?file=../../../../../../etc/passwd Impact This issue may lead to Information Disclosure. Remediation Normalize file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths. See also: [CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/) [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal) |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 6.4 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 6.5 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-cp65-5m9r-vc2c/GHSA-cp65-5m9r-vc2c.json |
| cvssv4 | 7.1 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-cp65-5m9r-vc2c/GHSA-cp65-5m9r-vc2c.json |
| generic_textual | HIGH |
| Data source | Metasploit |
|---|---|
| Description | Exploits CVE-2024-46987, an authenticated directory traversal vulnerability in Camaleon CMS versions <= 2.8.0 and 2.9.0 |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | Aug. 8, 2024 |
| Platform | Linux |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather/camaleon_download_private_file.rb |
| Data source | Exploit-DB |
|---|---|
| Date added | April 30, 2026 |
| Description | Camaleon CMS v2.9.0 - Path Traversal |
| Ransomware campaign use | Unknown |
| Source publication date | April 30, 2026 |
| Exploit type | webapps |
| Platform | multiple |
| Source update date | April 30, 2026 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-18T18:57:11Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2024/46xxx/CVE-2024-46987.json
Source Advisory: vulnrichment/CVE-2024-46987
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]