- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 12 · 3 critical, 2 high, 6 medium
- Registry
- RubyGems
Advisories 12
- CVE-2026-86100Medium 5.3
Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL
Affected: from 2.7.5, fixed in 2.9.2.
- CVE-2026-1776Medium 6.0
Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read
Affected: from 2.4.5.0, through 2.9.1.
- CVE-2025-2304Critical 9.4
Camaleon CMS Privilege Escalation
Affected: fixed in 2.9.1.
- CVE-2024-48652Medium 4.8
Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name…
Affected: through 2.7.5.
- CVE-2024-46987High 7.7
Arbitrary path traversal in Camaleon CMS
Affected: fixed in 2.8.1.
- CVE-2024-46986Critical 10.0
Arbitrary file write leading to RCE in Camaleon CMS
Affected: from 2.8.0, fixed in 2.8.1.
- CVE-2023-30145Critical 9.8
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.
Affected: fixed in 2.7.4.
- CVE-2021-25972Medium 4.9
Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature
Affected: from 2.1.2.0, fixed in 2.6.0.1.
- CVE-2021-25971Medium 4.3
Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature
Affected: from 2.0.1, fixed in 2.6.0.1.
- CVE-2021-25970High 8.8
Camaleon CMS - Insufficient Session Expiration after Password Change
Affected: from 0.1.7, fixed in 2.6.0.1.
- CVE-2021-25969Medium 6.1
Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments
Affected: from 0.0.1, fixed in 2.6.0.1.
- CVE-2018-18260Unrated
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered.
Affected: versions 2.4.