Summary
A path traversal vulnerability in Camaleon CMS allows users with media permission to write files outside the intended media directory by supplying parent-directory sequences in a filename parameter. If an attacker can submit crafted media content, they may place an ERB template in a theme views directory, which could execute when the affected view is rendered.
A path traversal vulnerability in Camaleon CMS allows users with media permission to write files outside the intended media directory by supplying parent-directory sequences in a filename parameter. If an attacker can submit crafted media content, they may place an ERB template in a theme views directory, which could execute when the affected view is rendered.
Affected context
The issue occurs in the CMS media workflow when the crop_url action accepts a user-controlled name parameter and uses it to construct a destination path without sufficiently constraining the resulting location. Deployments are at greater risk when users with only media-related permissions can influence file paths and when writable theme view directories are processed as executable templates.
The issue occurs in the CMS media workflow when the crop_url action accepts a user-controlled name parameter and uses it to construct a destination path without sufficiently constraining the resulting location. Deployments are at greater risk when users with only media-related permissions can influence file paths and when writable theme view directories are processed as executable templates.
Exploit preconditions
- Attack surface: The Camaleon CMS media handling and
crop_urlaction - Required access: A CMS account or session with media permission
- Trigger point: Processing a media request containing a crafted filename and data URI
- Why exploitation is possible: Relative path components can escape the intended media directory, allowing attacker-controlled content to be written into a location that may be interpreted as an ERB view
- Attack surface: The Camaleon CMS media handling and
crop_urlaction - Required access: A CMS account or session with media permission
- Trigger point: Processing a media request containing a crafted filename and data URI
- Why exploitation is possible: Relative path components can escape the intended media directory, allowing attacker-controlled content to be written into a location that may be interpreted as an ERB view
Why this happens
The vulnerability results from treating a user-controlled filename as a trusted filesystem path. When path components such as parent-directory references are not canonicalized and constrained to an approved directory, the application may resolve the destination outside its intended boundary. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, and becomes more severe when written content is placed in a server-side template directory.
The vulnerability results from treating a user-controlled filename as a trusted filesystem path. When path components such as parent-directory references are not canonicalized and constrained to an approved directory, the application may resolve the destination outside its intended boundary. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, and becomes more severe when written content is placed in a server-side template directory.
Potential impact
- An attacker may write arbitrary files within locations accessible to the application
- Server-side template injection may occur when a planted ERB file is rendered
- The application process could execute attacker-controlled server-side logic
- Sensitive application data may be modified, deleted, or overwritten
- The compromise could enable further access depending on process privileges and deployment isolation
- An attacker may write arbitrary files within locations accessible to the application
- Server-side template injection may occur when a planted ERB file is rendered
- The application process could execute attacker-controlled server-side logic
- Sensitive application data may be modified, deleted, or overwritten
- The compromise could enable further access depending on process privileges and deployment isolation
General mitigation guidance
Mitigation generally focuses on treating filenames and storage paths as untrusted data and enforcing a strict destination boundary.
Common defensive patterns include:
- Resolve and canonicalize candidate paths before writing, then verify they remain beneath an approved storage root
- Reject traversal components, encoded variants, absolute paths, and unexpected separators
- Generate server-side filenames rather than accepting client-selected filesystem names
- Store uploaded content outside executable template and application code directories
- Allow only approved content types and enforce size and format validation
- Apply least-privilege permissions to the CMS process and writable directories
- Separate media storage from directories interpreted as ERB or other executable templates
Mitigation generally focuses on treating filenames and storage paths as untrusted data and enforcing a strict destination boundary.
Common defensive patterns include:
- Resolve and canonicalize candidate paths before writing, then verify they remain beneath an approved storage root
- Reject traversal components, encoded variants, absolute paths, and unexpected separators
- Generate server-side filenames rather than accepting client-selected filesystem names
- Store uploaded content outside executable template and application code directories
- Allow only approved content types and enforce size and format validation
- Apply least-privilege permissions to the CMS process and writable directories
- Separate media storage from directories interpreted as ERB or other executable templates
How teams detect issues like this
Organizations can look for path traversal risks through:
- Static analysis rules identifying filesystem writes that incorporate request parameters
- Code review checks for missing canonicalization and destination-boundary validation
- Tests covering encoded, nested, absolute, and alternate-separator path inputs
- Runtime monitoring for unexpected writes outside designated media directories
- Policy enforcement that prevents application processes from writing to template or code paths
- Automated security review tools that flag user-controlled path construction and unrestricted upload handling
Organizations can look for path traversal risks through:
- Static analysis rules identifying filesystem writes that incorporate request parameters
- Code review checks for missing canonicalization and destination-boundary validation
- Tests covering encoded, nested, absolute, and alternate-separator path inputs
- Runtime monitoring for unexpected writes outside designated media directories
- Policy enforcement that prevents application processes from writing to template or code paths
- Automated security review tools that flag user-controlled path construction and unrestricted upload handling
