Camaleon CMS versions 2.7.5 through 2.9.1 contain a server‑side request forgery flaw in the "Upload from URL" media function. Authenticated users can provide an external URL that passes the CMS's initial validation but ultimately redirects to an internal network address. Once the server follows that redirect, the attacker can make HTTP requests to internal services, potentially exfiltrating data or triggering actions on those services. This vulnerability does not allow remote code execution or escalation beyond the authenticated user's privileges, but it does expose internal infrastructure to an attacker who can already authenticate to the CMS.

The affected product is CamaleonCMS, developed by owen2345. All released versions from 2.7.5 up to and including 2.9.1 are impacted. The flaw is present in the uploader helper module responsible for handling remote file imports. No other vendors or versions are listed as affected.

The CVSS score of 5.3 indicates a moderate impact, with the primary risk being SSRF into internal resources. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Breach requires the attacker to be authenticated to the CMS, which limits the immediate threat surface but still allows the exploration of internal services. Exploitation is straightforward: the attacker logs in, uses the upload feature with a malicious URL, and the server follows the redirect to reach an internal endpoint. No known public exploit exists at this time, but the attacker can customize the URL to target any internal service accessible from the CMS server.