CVE-2026-86100

MEDIUM 6.4

Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL

CVSS Score

6.4

EPSS Score

0.0%

EPSS Percentile

0th

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.

CWE	CWE-918
Vendor	owen2345
Product	camaleoncms
Published	Sep 4, 2026
Last Updated	Sep 8, 2026

Stay Ahead of the Next One

Get instant alerts for owen2345 camaleoncms

Be the first to know when new medium vulnerabilities affecting owen2345 camaleoncms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

owen2345 / CamaleonCMS

2.7.5 < 2.9.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/owen2345/camaleon-cms github.com: https://github.com/owen2345/camaleon-cms/pull/1133 github.com: https://github.com/owen2345/camaleon-cms/commit/3c46b6e512518ded476226162305c8eae00aac3f github.com: https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/helpers/camaleon_cms/uploader_helper.rb github.com: https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2 vulncheck.com: https://www.vulncheck.com/advisories/camaleon-cms-2.7.5-through-2.9.1-ssrf-via-http-redirect-in-upload-from-url

Credits

Minjun Lee (AhnLab, Inc.)