# camaleon\_cms (RubyGems) vulnerabilities

12 known vulnerabilities (3 critical, 2 high, 6 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://rubygems.org/gems/camaleon_cms

## Advisories (12)

### [CVE-2026-86100](https://cve.now/CVE-2026-86100): Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL

- Severity: Medium 5.3
- Published: Sep 4, 2026
- Affected: from 2.7.5, fixed in 2.9.2.

### [CVE-2026-1776](https://cve.now/CVE-2026-1776): Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read

- Severity: Medium 6.0
- Published: Mar 9, 2026
- Affected: from 2.4.5.0, through 2.9.1.

### [CVE-2025-2304](https://cve.now/CVE-2025-2304): Camaleon CMS Privilege Escalation

- Severity: Critical 9.4
- Published: Mar 14, 2025
- Affected: fixed in 2.9.1.

### [CVE-2024-48652](https://cve.now/CVE-2024-48652): Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name…

- Severity: Medium 4.8
- Published: Oct 22, 2024
- Affected: through 2.7.5.

### [CVE-2024-46987](https://cve.now/CVE-2024-46987): Arbitrary path traversal in Camaleon CMS

- Severity: High 7.7
- Published: Sep 18, 2024
- Affected: fixed in 2.8.1.

### [CVE-2024-46986](https://cve.now/CVE-2024-46986): Arbitrary file write leading to RCE in Camaleon CMS

- Severity: Critical 10.0
- Published: Sep 18, 2024
- Affected: from 2.8.0, fixed in 2.8.1.

### [CVE-2023-30145](https://cve.now/CVE-2023-30145): Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

- Severity: Critical 9.8
- Published: May 26, 2023
- Affected: fixed in 2.7.4.

### [CVE-2021-25972](https://cve.now/CVE-2021-25972): Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature

- Severity: Medium 4.9
- Published: Oct 20, 2021
- Affected: from 2.1.2.0, fixed in 2.6.0.1.

### [CVE-2021-25971](https://cve.now/CVE-2021-25971): Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature

- Severity: Medium 4.3
- Published: Oct 20, 2021
- Affected: from 2.0.1, fixed in 2.6.0.1.

### [CVE-2021-25970](https://cve.now/CVE-2021-25970): Camaleon CMS - Insufficient Session Expiration after Password Change

- Severity: High 8.8
- Published: Oct 20, 2021
- Affected: from 0.1.7, fixed in 2.6.0.1.

### [CVE-2021-25969](https://cve.now/CVE-2021-25969): Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments

- Severity: Medium 6.1
- Published: Oct 20, 2021
- Affected: from 0.0.1, fixed in 2.6.0.1.

### [CVE-2018-18260](https://cve.now/CVE-2018-18260): In the 2.4 version of Camaleon CMS, Stored XSS has been discovered.

- Severity: Unrated
- Published: Oct 15, 2018
- Affected: versions 2.4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/rubygems/camaleon_cms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.