CVE-2024-46987: Camaleon CMS Path Traversal Vulnerability

CVE-2024-46987 Overview

CVE-2024-46987 is a path traversal vulnerability in Camaleon CMS, a Ruby on Rails-based content management system maintained by Tuzitio. The flaw resides in the download_private_file method of MediaController. Authenticated users can supply crafted path parameters to download arbitrary files from the web server's filesystem, constrained only by the process's file permissions. The vulnerability maps to [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and can lead to disclosure of source code, configuration files, and credentials. Camaleon CMS release 2.8.2 addresses the issue. No workarounds are available.

Critical Impact
Any authenticated Camaleon CMS user can read arbitrary files from the underlying web server, including application secrets, database credentials, and system configuration files.

Affected Products

Tuzitio Camaleon CMS versions prior to 2.8.2
Ruby on Rails deployments running vulnerable Camaleon CMS releases
Any multi-tenant environment exposing the Camaleon CMS MediaController to authenticated users

Discovery Timeline

2024-09-18 - CVE-2024-46987 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-46987

Vulnerability Analysis

The vulnerability exists in Camaleon CMS's MediaController#download_private_file action. The controller accepts a user-supplied file path parameter and passes it to file-serving logic without normalizing directory traversal sequences. Authenticated attackers submit values containing ../ segments to escape the intended private media directory. The Rails process then reads the resolved file and returns its contents in the HTTP response.

Successful exploitation exposes any file the Rails application user can read. Typical targets include config/database.yml, config/master.key, config/credentials.yml.enc, .env files, SSH private keys under the service account's home directory, and /etc/passwd. Exposure of Rails master keys enables decryption of the encrypted credentials store, which often contains third-party API tokens and production database passwords. The scope change reflected in the CVSS vector captures the ability to reach resources outside the CMS's intended trust boundary.

Root Cause

The download_private_file method concatenates a user-controlled path parameter with a base directory without applying canonicalization or an allowlist check. Ruby's File.join and send_file helpers do not filter .. sequences, so the resolved path can point anywhere on the filesystem. Static analysis rules such as the CodeQL Ruby Path Injection query flag this exact pattern.

Attack Vector

Exploitation requires network access and a valid authenticated session on the Camaleon CMS instance. The attacker issues a GET request to the private file download endpoint with a traversal payload in the file identifier parameter. The server resolves the path outside the private media directory and streams the target file back in the response body. No user interaction, elevated privileges, or complex chaining is required. Details are documented in the GitHub Security Advisory GHSA-cp65-5m9r-vc2c and the SecurityLab writeup.

Detection Methods for CVE-2024-46987

Indicators of Compromise

HTTP requests to Camaleon CMS media download endpoints containing ../, ..%2f, or URL-encoded traversal sequences in the file path parameter
Rails production logs showing MediaController#download_private_file returning files outside the configured private uploads directory
Unexpected access to sensitive files such as database.yml, credentials.yml.enc, .env, or master.key by the web application process

Detection Strategies

Deploy web application firewall rules that inspect query strings and path parameters for directory traversal patterns against Camaleon CMS routes
Enable Rails request logging with parameter capture and alert on download_private_file invocations that resolve to paths outside the expected upload root
Correlate authenticated session activity with file read events on the underlying host to identify anomalous access patterns

Monitoring Recommendations

Forward Rails application logs and reverse proxy access logs to a centralized SIEM for continuous inspection
Baseline normal file access patterns for the Camaleon CMS service account and alert on reads outside the media directory
Track authentication events and correlate low-privilege accounts issuing repeated download requests targeting varied file paths

How to Mitigate CVE-2024-46987

Immediate Actions Required

Upgrade Camaleon CMS to version 2.8.2 or later on all production and staging instances
Rotate Rails master.key, database credentials, API tokens, and any secrets stored in credentials.yml.enc if the instance was internet-exposed
Audit authentication logs and file access logs for prior exploitation attempts against download_private_file
Review user accounts and remove or disable inactive authenticated users that could be leveraged for exploitation

Patch Information

The maintainer released Camaleon CMS 2.8.2 containing the fix. Details are published in the official advisory GHSA-cp65-5m9r-vc2c and the 2.8.1 release discussion. Upgrade using the Ruby package manager and redeploy the application. Additional background on this class of flaw is available in the OWASP Path Traversal reference.

Workarounds

No vendor-supplied workarounds exist; upgrading to 2.8.2 is the only supported remediation
As a temporary compensating control, restrict access to the Camaleon CMS admin interface using network-level allowlisting until the patch is applied
Run the Rails application under a dedicated low-privilege user account with filesystem access limited to required directories to reduce the blast radius

bash

# Upgrade Camaleon CMS to the patched release
bundle update camaleon_cms --to 2.8.2
bundle exec rails db:migrate
bundle exec rails assets:precompile
systemctl restart puma