CVE-2024-46987
CVSS v3
7.7
HIGH
EPSS Score
14.6 %
exploit probability, as of 2026-09-25
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Technical details
- Published
- 2024-09-18
- Exploit-DB
- EDB-52531
Frequently asked questions
What is CVE-2024-46987?
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Is CVE-2024-46987 actively exploited?
Active exploitation of CVE-2024-46987 has not been confirmed. Its EPSS score was 14.6% on 2026-09-25, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-46987?
CVE-2024-46987 has a CVSS v3 base score of 7.7 (HIGH severity).
Is CVE-2024-46987 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2024 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).