Camaleon CMS versions older than 2.9.3 contain a path traversal flaw that lets a user with media permissions write arbitrary files to the server through the name parameter of the crop_url media action. By provisioning a base64 data URI in this parameter the attacker can create an ERB template inside a theme’s views directory. When that view is later rendered the embedded code executes, giving the attacker full control of the web application, which is a classic example of remote code execution stemming from an input validation weakness (CWE‑22).

The vulnerability affects installations of Camaleon CMS from any release preceding 2.9.3. Users who have installed the open‑sourceCMS made by owen2345 and have granted themselves the media permission are susceptible. The issue is tied to the media crop_url action, so any instance that exposes this functionality to normal users is at risk.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS metric is not available, but the vulnerability is not recorded in the CISA KEV listing. An attacker only needs to be authenticated with media permission, which many CMS users possess, to craft a malicious request. The path traversal allows writing to arbitrary locations, and the injected ERB template can be executed when the site renders the view. Consequently, if an exploitable view is rendered, the attacker can execute any Ruby code on the server, effectively compromising the entire site.