Path Traversal Affecting camaleon_cms package, versions <2.8.1
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-CAMALEONCMS-8056484
- published19 Sept 2024
- disclosed18 Sept 2024
- creditAurel Branzeanu
Introduced: 18 Sep 2024
CVE NOT AVAILABLE CWE-22 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade camaleon_cms to version 2.8.1 or higher.
Overview
camaleon_cms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress.
Affected versions of this package are vulnerable to Path Traversal through the actions method and the subsequent delete_file method. An attacker can delete arbitrary files on the server by manipulating the folder path parameter to escape the intended directory.