Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ruby_advisory_db / gems/camaleon_cms/CVE-2026-1776
Advisory ID ruby_advisory_db/gems/camaleon_cms/CVE-2026-1776
Aliases CVE-2026-1776
GHSA-jw5g-f64p-6x78
Summary Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3 6.5
cvssv4 6.0
Reference id Reference type URL
https://nvd.nist.gov/vuln/detail/CVE-2026-1776
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-10T14:57:09Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/1xxx/CVE-2026-1776.json

Source Advisory: vulnrichment/CVE-2026-1776

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]