Description

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-05T00:17:20.810Z",
  "pubdate": "2026-09-05T00:17:20.810Z",
  "executiveSummary": "Camaleon CMS versions 2.7.5 through 2.9.1 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the media management component.\nThe vulnerability stems from inadequate validation of redirect targets during remote file fetching operations initiated via the 'Upload from URL' feature.\nAn authenticated attacker can manipulate the application into performing requests against arbitrary network endpoints, including internal resources that are otherwise inaccessible from the external network.\nThis flaw allows for unauthorized interaction with internal infrastructure, potentially leading to information disclosure, port scanning, or interaction with internal services that lack robust authentication.\nThe attack requires an authenticated session with sufficient privileges to access media upload functionality. The risk is significant in environments where the CMS server maintains connectivity to sensitive internal segments.",
  "technicalDetails": "The vulnerability exists within the remote file fetching mechanism of Camaleon CMS, specifically in the component responsible for processing uploads from external URLs. The root cause is an improper handling of HTTP redirects during the resource retrieval process.\nWhen a user provides a URL to the 'Upload from URL' feature, the application performs an initial validation check on the supplied target. However, this validation is insufficient as it fails to account for subsequent HTTP redirect responses (e.g., 301, 302, 307) that may occur after the initial request is initiated.\nAn attacker can exploit this by supplying a URL pointing to an attacker-controlled server. This server is configured to return an HTTP redirect response pointing to an internal network address (e.g., http://127.0.0.1:port or http://internal-service.local). The CMS backend follows these redirects automatically without re-validating the final destination against the same security policies applied to the initial input.\nThe attack flow follows these steps: 1) The authenticated attacker submits a crafted URL to the media management interface. 2) The CMS initiates a server-side GET request to the attacker's server. 3) The attacker's server responds with a redirect header (e.g., Location: http://169.254.169.254/latest/meta-data/). 4) The Camaleon CMS server, acting as a proxy, follows the redirect and executes the request to the restricted internal endpoint. 5) The CMS may then inadvertently process or reflect the response content back to the user, or use the successful connection to map internal network topology.\nBecause the request is initiated from the server's context, it originates from a trusted network zone. This bypasses typical perimeter firewall controls, allowing the attacker to interact with internal APIs, databases, or management interfaces that rely on IP-based trust models. The vulnerability is present in versions 2.7.5 through 2.9.1 and necessitates authenticated access, as the upload functionality is typically restricted to authorized administrative users."
}