Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/camaleon_cms@2.4.5.13
purl pkg:gem/camaleon_cms@2.4.5.13
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 10.0
Vulnerabilities affecting this package (22)
Advisory Summary Fixed in package version
CVE-2018-18260
Aliases:
GHSA-7f84-9cqf-g4j9
Camaleon CMS vulnerable to Stored Cross-site Scripting In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The … There are no reported fixed by versions.
CVE-2021-25972
Aliases:
GHSA-vx6p-q4gj-x6xx
Camaleon CMS vulnerable to Server-Side Request Forgery In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side Request Forgery … There are no reported fixed by versions.
CVE-2021-25969
Aliases:
GHSA-x78v-4fvj-rg9j
Camaleon CMS Stored Cross-site Scripting vulnerability In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that … There are no reported fixed by versions.
CVE-2021-25970
Aliases:
GHSA-438x-2p9v-g8h9
Camaleon CMS Insufficient Session Expiration vulnerability Camaleon CMS 0.1.7 through 2.6.0 doesn’t terminate the active session of the users, even … There are no reported fixed by versions.
CVE-2021-25971
Aliases:
GHSA-r2w2-h6r8-3r53
Camaleon CMS vulnerable to Uncaught Exception In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught Exception. The … There are no reported fixed by versions.
GHSA-rp28-mvq3-wf8j
Aliases:
CVE-2025-2304
Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment A Privilege Escalation through a Mass Assignment exists in Camaleon …
2.9.1
Vulnerable
GHSA-vx6p-q4gj-x6xx
Aliases:
CVE-2021-25972
Camaleon CMS vulnerable to Server-Side Request Forgery In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side Request Forgery …
2.6.0.1
Vulnerable
GHSA-r2w2-h6r8-3r53
Aliases:
CVE-2021-25971
Camaleon CMS vulnerable to Uncaught Exception In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught Exception. The …
2.6.0.1
Vulnerable
GHSA-x78v-4fvj-rg9j
Aliases:
CVE-2021-25969
Camaleon CMS Stored Cross-site Scripting vulnerability In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that …
2.6.0.1
Vulnerable
GHSA-438x-2p9v-g8h9
Aliases:
CVE-2021-25970
Camaleon CMS Insufficient Session Expiration vulnerability Camaleon CMS 0.1.7 through 2.6.0 doesn’t terminate the active session of the users, even …
2.6.0.1
Vulnerable
GHSA-hhxg-rvc9-8726
Aliases:
CVE-2024-48652
camaleon_cms affected by cross site scripting Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code … There are no reported fixed by versions.
GHSA-3hp8-6j24-m5gm

Duplicate Advisory: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185) # Duplicate Advisory This advisory has been …
2.8.1
Vulnerable
GHSA-cp65-5m9r-vc2c
Aliases:
CVE-2024-46987
Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183) A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users …
2.8.1
Vulnerable
GHSA-r9cr-qmfw-pmrc

Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) A stored cross-site scripting has been found in the …
2.8.1
Vulnerable
GHSA-8fx8-3rg2-79xw

Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) A stored cross-site scripting has been found in the …
2.8.1
Vulnerable
GHSA-7x4w-cj9r-h4v9

Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185) The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52) defined inside of the MediaController class do …
2.8.1
Vulnerable
GHSA-x487-866m-p8hr
Aliases:
CVE-2023-30145
Server-Side Template Injection in Camaleon CMS Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection (SSTI) …
2.7.4
Vulnerable
GHSA-jw5g-f64p-6x78
Aliases:
CVE-2026-1776
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit … There are no reported fixed by versions.
CVE-2026-1776
Aliases:
GHSA-jw5g-f64p-6x78
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit … There are no reported fixed by versions.
CVE-2023-30145
Aliases:
GHSA-x487-866m-p8hr
Server-Side Template Injection in Camaleon CMS Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via …
2.7.1
Vulnerable
2.7.1
Vulnerable
CVE-2026-66748
Aliases:
GHSA-7xm9-634w-f5r7
Camaleon CMS (2.1.1 to 2.9.1) contains an authenticated RCE vulnerability Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote … There are no reported fixed by versions.
CVE-2026-1776
Aliases:
GHSA-jw5g-f64p-6x78
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit … There are no reported fixed by versions.
This package is not known to fix any advisories.