CVE-2021-25972: In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch…

PriorityP426medium4.9CVSS 3.1

AVNACLPRHUINSUCHINAN

EPSS

0.95%

56.9th percentile

In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
camaleon_cms	camaleon_cms	>= 2.1.2.0 < unspecified	unspecified
camaleon_cms	camaleon_cms	>= 2.1.2.0 < 2.6.0.1	2.6.0.1
camaleon_cms	camaleon_cms	unspecified – 2.6.0	—
tuzitio	camaleon_cms	2.1.2.0 – 2.6.0	—

CVSS provenance

nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.