Is CVE-2026-86100 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86100 being exploited in the wild.

How severe is CVE-2026-86100?

Medium severity, with a CVSS score of 6.4, published 5 September 2026.

Which products and versions are affected?

Owen Peredo Diaz Camaleon CMS 2.7.5 through 2.9.1.

Is there a fix for CVE-2026-86100?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86100 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86100?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86100: Camaleon CMS server-side request forgery in upload from URL

CVE-2026-86100 · Severity: medium · CVSS 6.4 · Published 2026-09-05

Camaleon CMS, a Ruby-based content management system, contains a flaw in its "Upload from URL" media feature that allows authenticated users to upload files from external URLs. Attackers can exploit improper redirect validation to force the server to fetch files from internal network addresses, potentially accessing sensitive services or data not exposed to the public internet.

Quick answers

Is CVE-2026-86100 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86100 being exploited in the wild.
How severe is CVE-2026-86100?: Medium severity, with a CVSS score of 6.4, published 5 September 2026.
Which products and versions are affected?: Owen Peredo Diaz Camaleon CMS 2.7.5 through 2.9.1.
Is there a fix for CVE-2026-86100?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86100 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86100?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in versions 2.7.5 through 2.9.1 and is classified as a server-side request forgery (SSRF) issue. The root cause is insufficient validation of HTTP redirect targets during remote file fetching operations. An authenticated attacker can provide a URL that passes initial validation but redirects to an internal network address, allowing the server to make requests to services behind the firewall. The attack requires authentication and network access to the CMS application. This flaw has been addressed in later versions (2.9.2 and beyond include fixes based on available versions).

Affected products

Owen Peredo Diaz Camaleon CMS 2.7.5 through 2.9.1

Timeline

2026-09-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.