CVE-2026-73330
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.
Risk Assessment
The risk is critical: an authenticated administrator can execute arbitrary commands on the server, which can lead to full system compromise and breach of confidentiality, integrity, and availability.
Recommendation
It is recommended to immediately update CamaleonCMS to a version containing the fix and restrict access to the admin panel.
Original NVD description (English source)
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.