https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:20:11.408645+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-231618 EUVD-2026-231618 2026-10-06T22:20:11.459612+00:00 EUVD-2026-231618 https://cve.radiocsirt.org/vuln/fkie_cve-2024-46987 fkie_cve-2024-46987 2026-10-06T22:20:11.459656+00:00

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-cp65-5m9r-vc2c GHSA-cp65-5m9r-vc2c — Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183) 2026-10-06T22:20:11.459695+00:00

Affected: RubyGems: camaleon_cms

A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions).

In the [download_private_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L28) method: ```ruby def download_private_file cama_uploader.enable_private_mode!

file = cama_uploader.fetch_file("private/#{params[:file]}")

send_file file, disposition: 'inline' end ``` The file parameter is passed to the [fetch_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_local_uploader.rb#L27) method of the CamaleonCmsLocalUploader class (when files are uploaded locally): ```ruby def fetch_file(file_name) raise ActionController::RoutingError, 'File not found' unless file_exists?(file_name)

file_name end ``` If the file exists it's passed back to the download_private_file method where the file is sent to the user via [send_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L33-L34).

Proof of concept An authenticated user can download the /etc/passwd file by visiting an URL such as:

https://<camaleon-host>/admin/media/download_private_file?file=../../../../../../etc/passwd Impact This issue may lead…