# CVE-2026-1776: Camaleon CMS path traversal in AWS S3 uploader

Source: https://junglewise.ai/threats/cve-2026-1776-camaleon-cms-path-traversal-in-aws-s3-uploader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-1776 · Severity: medium · CVSS 6.5 · Published 2026-03-10

Camaleon CMS is a content management system built on Ruby on Rails. A security flaw in its AWS S3 storage component allows logged-in users, even those with low privileges, to access sensitive files on the web server's filesystem. This could lead to the exposure of critical system information, such as user credentials or configuration files.

Technologies: [camaleon_cms (RubyGems)](https://junglewise.ai/threats/technologies/camaleon-cms). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-1776 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1776 being exploited in the wild.

**How severe is CVE-2026-1776?** Medium severity, with a CVSS score of 6.5, published 10 March 2026.

**Which products and versions are affected?** camaleon_cms (RubyGems) >= 2.4.5.0, <= 2.9.1, ECOSYSTEM:introduced=2.4.5.0,last_affected=2.9.1.

**Is there a fix for CVE-2026-1776?** A patch was published on 2026-03-09: Fix merged into master branch via commit f54a77e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1776 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-1776?** Check whether you run camaleon_cms (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the CamaleonCmsAwsUploader backend of Camaleon CMS. The issue resides in the download_private_file functionality, where the AWS uploader fails to validate file paths using the valid_folder_path? method, unlike the local uploader implementation. An authenticated attacker can provide directory traversal sequences (e.g., ../) via the 'file' parameter to bypass directory restrictions. This allows for the retrieval of sensitive files like /etc/passwd. This vulnerability is a bypass of an incomplete fix for a previous issue (CVE-2024-46987) and has been addressed in commit f54a77e.

## Affected products

- owen2345 Camaleon CMS 2.4.5.0 through 2.9.0

## Identifiers

- CVE-2026-1776
- GHSA-jw5g-f64p-6x78

## Timeline

- 2026-03-08: disclosed: Pull request submitted to fix the vulnerability
- 2026-03-09: patched: Fix merged into master branch via commit f54a77e
- 2026-03-10: advisory: CVE-2026-1776 published

## References

- [https://camaleon.website/](https://camaleon.website/)
- [https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af](https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af)
- [https://github.com/owen2345/camaleon-cms/pull/1127](https://github.com/owen2345/camaleon-cms/pull/1127)
- [https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read](https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read)

## Related threats

- [Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment](https://junglewise.ai/threats/cve-2025-2304-camaleon-cms-vulnerable-to-privilege-escalation-through-a-mass)
- [camaleon_cms affected by cross site scripting](https://junglewise.ai/threats/cve-2024-48652-camaleon-cms-affected-by-cross-site-scripting)
- [Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)](https://junglewise.ai/threats/camaleon-cms-vulnerable-to-stored-xss-through-user-file-upload-ghsl-0a6a9b46)
- [Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)](https://junglewise.ai/threats/camaleon-cms-vulnerable-to-stored-xss-through-user-file-upload-ghsl-15da3087)
- [Duplicate Advisory: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)](https://junglewise.ai/threats/duplicate-advisory-camaleon-cms-vulnerable-to-remote-code-execution-4aed8853)