Path Traversal Affecting camaleon_cms package, versions <2.8.1
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-CAMALEONCMS-8056484
- published 19 Sep 2024
- disclosed 18 Sep 2024
- credit Aurel Branzeanu
How to fix?
Upgrade camaleon_cms to version 2.8.1 or higher.
Overview
camaleon_cms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress.
Affected versions of this package are vulnerable to Path Traversal through the actions method and the subsequent delete_file method. An attacker can delete arbitrary files on the server by manipulating the folder path parameter to escape the intended directory.