{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"2.4.5.0","last_affected":"2.9.1"}],"component":"camaleon_cms","cve_ids":["CVE-2026-1776"],"ecosystem":"RubyGems","epss":0.00777,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jw5g-f64p-6x78","id":"tcs_01M5KEM1CXH7PJGHJBMMTA3M7Z","modified_at":"2026-05-05T15:58:51.709196Z","published_at":"2026-03-10T09:31:46Z","references":["https://osv.dev/vulnerability/GHSA-jw5g-f64p-6x78","https://nvd.nist.gov/vuln/detail/CVE-2026-1776","https://github.com/owen2345/camaleon-cms/pull/1127","https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af","https://camaleon.website","https://github.com/owen2345/camaleon-cms","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2026-1776.yml","https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-jw5g-f64p-6x78","url":"https://osv.dev/vulnerability/GHSA-jw5g-f64p-6x78"}],"summary":"Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation"}