CVE-2026-86100: Camaleon CMS SSRF Vulnerability

CVE-2026-86100 Overview

Camaleon CMS versions 2.7.5 through 2.9.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the Upload from URL media feature. The application validates the initial URL supplied by an authenticated user but fails to re-validate redirect targets returned by the remote server. An attacker can supply an external URL that responds with an HTTP redirect pointing to internal network addresses, causing the server to fetch resources from internal services. This weakness is tracked as [CWE-918].

Critical Impact
Authenticated attackers can pivot through the Camaleon CMS server to reach internal-only services, metadata endpoints, and other resources not exposed to the public internet.

Affected Products

Camaleon CMS 2.7.5
Camaleon CMS versions 2.7.6 through 2.9.0
Camaleon CMS 2.9.1

Discovery Timeline

2026-09-05 - CVE-2026-86100 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86100

Vulnerability Analysis

Camaleon CMS exposes an Upload from URL feature that fetches remote files and stores them in the media library. The uploader_helper.rb component performs validation on the URL supplied by the user before initiating the HTTP request. When the remote server responds with an HTTP 3xx redirect, the underlying HTTP client follows the Location header without applying the same host and address checks to the new target. Authenticated attackers with upload permissions can abuse this behavior to coerce the server into issuing requests against internal network destinations. Typical SSRF targets include cloud metadata services, internal administrative interfaces, and services bound to loopback or RFC1918 addresses.

Root Cause

The root cause is missing redirect-target validation in the file fetch routine. Initial URL validation is bypassed once the HTTP client transparently follows a redirect. Because the check runs only against the user-supplied URL, a controlled external endpoint that returns a redirect to http://127.0.0.1 or http://169.254.169.254 is sufficient to reach internal endpoints from the Camaleon CMS host.

Attack Vector

Exploitation requires network access to the Camaleon CMS instance and an authenticated account with permission to use the Upload from URL feature. The attacker hosts an endpoint that returns a redirect to an internal target, submits its URL through the media upload flow, and observes application behavior or fetched content to enumerate internal resources.

ruby

# Patch context from app/helpers/camaleon_cms/html_helper.rb
# Source: https://github.com/owen2345/camaleon-cms/commit/3c46b6e512518ded476226162305c8eae00aac3f
quoted_key_match = key.match(/\A(['"])([a-zA-Z0-9_.-]+)\1\z/)
key = quoted_key_match[2] if quoted_key_match

# Only translate simple i18n keys so arbitrary Ruby is never evaluated.
# Allowed chars: a-z, A-Z, 0-9, _, ., and -.
return value unless key.match?(/\A[a-zA-Z0-9_.-]+\z/)

I18n.t(key)

Source: Camaleon CMS Commit 3c46b6e

Detection Methods for CVE-2026-86100

Indicators of Compromise

Outbound HTTP requests from the Camaleon CMS host to internal RFC1918 ranges or 127.0.0.1 originating from the media upload workflow.
Access log entries showing calls to the Upload from URL endpoint followed by unusual redirect chains to private addresses.
Requests from the CMS server to cloud instance metadata endpoints such as 169.254.169.254.

Detection Strategies

Inspect web server and application logs for Upload from URL requests where the fetched final destination differs from the submitted host.
Correlate authenticated user sessions with outbound HTTP connections initiated by the Rails process to non-public destinations.
Deploy egress filtering telemetry that flags server-initiated connections to internal management interfaces.

Monitoring Recommendations

Monitor the Camaleon CMS process for connections to loopback, link-local, and private address space.
Alert on repeated HTTP 3xx responses being followed by the CMS uploader helper within short time windows.
Track authenticated user accounts that generate high volumes of Upload from URL activity.

How to Mitigate CVE-2026-86100

Immediate Actions Required

Upgrade Camaleon CMS to version 2.9.2 or later, which contains the fix delivered in pull request #1133.
Audit accounts with media upload privileges and revoke access for unnecessary users.
Restrict outbound network access from the Camaleon CMS host to only the destinations required for normal operation.

Patch Information

The fix is available in Camaleon CMS Release 2.9.2 and merged through Pull Request #1133. See the VulnCheck Advisory for Camaleon CMS for additional context and the affected Uploader Helper Code.

Workarounds

Disable the Upload from URL feature until the upgrade is applied.
Place the Camaleon CMS server behind an egress proxy that blocks requests to private, loopback, and link-local address ranges.
On cloud deployments, enforce IMDSv2 or block access to the instance metadata endpoint from the CMS host.

bash

# Example egress restriction using iptables to block SSRF to internal ranges
iptables -A OUTPUT -m owner --uid-owner camaleon -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner camaleon -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner camaleon -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner camaleon -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner camaleon -d 169.254.0.0/16 -j REJECT