Login Request a demo
Medium severity · published Sep 4, 2026
CVE-2026-86100
Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
CamaleonCMS · owen2345
2.7.5 before 2.9.2 · source: vendor
Affected product
CA
CamaleonCMS
owen2345
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86100
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86100
github.com
https://github.com/owen2345/camaleon-cms
github.com
https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/helpers/camaleon_cms/uploader_helper.rb
github.com
https://github.com/owen2345/camaleon-cms/commit/3c46b6e512518ded476226162305c8eae00aac3f
github.com
https://github.com/owen2345/camaleon-cms/pull/1133
github.com
https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2
www.vulncheck.com
https://www.vulncheck.com/advisories/camaleon-cms-2.7.5-through-2.9.1-ssrf-via-http-redirect-in-upload-from-url
More from CamaleonCMS
8.8
CVE-2026-56721
CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController
8.7
CVE-2026-73332
CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field
8.7
CVE-2026-73329
CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint
7.6
CVE-2026-73326
CamaleonCMS Missing Authorization via Plugin Administration Endpoints
7.1
CVE-2026-73331
CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field