CVE-2024-46986

An authenticated arbitrary file write vulnerability exists in Camaleon CMS (versions before 2.8.2): the upload method of the MediaController does not properly constrain where uploaded files are written, so a user with low-privilege access can write files to any location on the web server, limited only by filesystem permissions. An attacker can abuse this by planting a Ruby file in the Rails config/initializers/ directory of the application, achieving delayed remote code execution when the application next loads, with critical impact (CVSS 9.9, high confidentiality/integrity/availability and scope change). Any deployment of Tuzitio's Camaleon CMS running a version prior to 2.8.2 is affected. No confirmed in-the-wild exploitation has been reported and the flaw is not in CISA KEV, but a public advisory with a proof-of-concept reference exists and EPSS assigns a 41% probability of exploitation within 30 days (99th percentile), so defenders should treat patching as urgent.

What to do: Upgrade to Camaleon CMS 2.8.2 or later, since there are no known workarounds. Restrict MediaController/upload access to trusted accounts and inspect the Rails config/initializers/ directory (and other writable paths) for unexpected or recently modified Ruby files that could indicate prior exploitation. Given the elevated EPSS score (41%, 99th percentile), prioritize patching immediately.