Is CVE-2026-1776 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1776 being exploited in the wild.

How severe is CVE-2026-1776?

Medium severity, with a CVSS score of 6.5, published 10 March 2026.

Which products and versions are affected?

camaleon_cms (RubyGems) >= 2.4.5.0, <= 2.9.1, ECOSYSTEM:introduced=2.4.5.0,last_affected=2.9.1.

Is there a fix for CVE-2026-1776?

A patch was published on 2026-03-09: Fix merged into master branch via commit f54a77e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1776 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-1776?

Check whether you run camaleon_cms (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1776: Camaleon CMS path traversal in AWS S3 uploader

Q: Is there a fix for CVE-2026-1776?

A patch was published on 2026-03-09: Fix merged into master branch via commit f54a77e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-1776 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-1776?

Check whether you run camaleon_cms (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1776 · Severity: medium · CVSS 6.5 · Published 2026-03-10

Camaleon CMS is a content management system built on Ruby on Rails. A security flaw in its AWS S3 storage component allows logged-in users, even those with low privileges, to access sensitive files on the web server's filesystem. This could lead to the exposure of critical system information, such as user credentials or configuration files.

Technologies: camaleon_cms (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-1776 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1776 being exploited in the wild.
How severe is CVE-2026-1776?: Medium severity, with a CVSS score of 6.5, published 10 March 2026.
Which products and versions are affected?: camaleon_cms (RubyGems) >= 2.4.5.0, <= 2.9.1, ECOSYSTEM:introduced=2.4.5.0,last_affected=2.9.1.
Is there a fix for CVE-2026-1776?: A patch was published on 2026-03-09: Fix merged into master branch via commit f54a77e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1776 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-1776?: Check whether you run camaleon_cms (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the CamaleonCmsAwsUploader backend of Camaleon CMS. The issue resides in the download_private_file functionality, where the AWS uploader fails to validate file paths using the valid_folder_path? method, unlike the local uploader implementation. An authenticated attacker can provide directory traversal sequences (e.g., ../) via the 'file' parameter to bypass directory restrictions. This allows for the retrieval of sensitive files like /etc/passwd. This vulnerability is a bypass of an incomplete fix for a previous issue (CVE-2024-46987) and has been addressed in commit f54a77e.

Affected products

owen2345 Camaleon CMS 2.4.5.0 through 2.9.0

Identifiers

CVE-2026-1776
GHSA-jw5g-f64p-6x78

Timeline

2026-03-08: disclosed: Pull request submitted to fix the vulnerability
2026-03-09: patched: Fix merged into master branch via commit f54a77e
2026-03-10: advisory: CVE-2026-1776 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.