Vendor
An authenticated path traversal vulnerability in Camaleon CMS allows attackers to read arbitrary files from the host server via the 'download_private_file' endpoint.