https://blog.msnieman.com/tags/camaleon-cms/Recent content in Camaleon CMS on Myles Nieman — BlogHugoen-usThu, 12 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/facts/Thu, 12 Feb 2026 00:00:00 +0000https://blog.msnieman.com/writeups/facts/A Ruby on Rails app running Camaleon CMS 2.9.0 is compromised via mass-assignment privilege escalation to admin, then an LFI in the admin file-download endpoint retrieves an SSH private key from an internal MinIO S3 bucket; the key cracks with JtR and SSH access leads to a sudo facter binary abused for root RCE.