Path Traversal Enables Arbitrary File Write in Camaleon CMS

Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Camaleon CMS versions prior to 2.9.3 contain a critical path traversal vulnerability (CWE-22) in the media handling functionality that allows attackers with minimal privileges to write arbitrary files to the server. By injecting ../ sequences into the name parameter of the crop_url media action, an attacker can escape the intended directory structure and place malicious ERB templates directly into the application's views directory. When these templates are subsequently rendered, the embedded code executes with application-level privileges, providing a direct path to remote code execution. This vulnerability is particularly dangerous because it requires only basic media permissions—a privilege level often granted liberally to content contributors—making it accessible to a broad class of potential attackers within organizations using Camaleon CMS.

Casky's skill library detects the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would see findings flagged for suspicious file write operations outside intended directories, detection of base64-encoded data: URI payloads being processed by media handlers, and path normalization failures that allow directory traversal sequences to bypass validation. Claude's extended reasoning capabilities enable the platform to correlate multiple indicators—such as unusual ../ patterns in API parameters combined with ERB template extensions in uncommon file paths—to identify exploitation attempts that simpler signature-based tools might miss. The 351 matched skills provide comprehensive detection across input validation bypasses, privilege escalation indicators, and post-exploitation code execution patterns, allowing security practitioners to identify both the initial compromise vector and the subsequent template injection that leads to RCE.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-116009.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-116009

Casky has 351 skills that investigate the attack patterns behind CVE-2026-116009. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn