Answer in brief
CVE-2026-1776 records a Medium severity (CVSS 6.0) vulnerability in Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read. The current sources do not mark it as known exploited. The current feed maps owen2345/Camaleon CMS (generic), camaleon_cms (rubygems). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps owen2345/Camaleon CMS (generic), camaleon_cms (rubygems). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| owen2345/Camaleon CMSgeneric | >=2.4.5.0 <=2.9.0 | Not reported |
| camaleon_cmsrubygems | >=2.4.5.0 | Not reported |
Published upstream
Mar 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows authenticated users to read arbitrary files from the web server’s filesystem. The issue occurs in the download_private_file functionality when the application is configured to use the CamaleonCmsAwsUploader backend. Unlike the local uploader implementation, the AWS uploader does not validate file paths with valid_folder_path?, allowing directory traversal sequences to be supplied via the file parameter. As a result, any authenticated user, including low-privileged registered users, can access sensitive files such as /etc/passwd. This issue represents a bypass of the incomplete fix for CVE-2024-46987 and affects deployments using the AWS S3 storage backend.
Quoted source text, attributed separately from HOL analysis.