Executive brief
Camaleon CMS, a Ruby-based content management system, contains a flaw in its "Upload from URL" media feature that allows authenticated users to upload files from external URLs. Attackers can exploit improper redirect validation to force the server to fetch files from internal network addresses, potentially accessing sensitive services or data not exposed to the public internet.
Technical details
The vulnerability exists in versions 2.7.5 through 2.9.1 and is classified as a server-side request forgery (SSRF) issue. The root cause is insufficient validation of HTTP redirect targets during remote file fetching operations. An authenticated attacker can provide a URL that passes initial validation but redirects to an internal network address, allowing the server to make requests to services behind the firewall. The attack requires authentication and network access to the CMS application. This flaw has been addressed in later versions (2.9.2 and beyond include fixes based on available versions).
Affected products
- Owen Peredo Diaz Camaleon CMS 2.7.5 through 2.9.1
Timeline
- 2026-09-05: disclosed