CVE-2026-66748 in Camaleon CMS
Summary
by MITRE • 07/28/2026
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability exists within Camaleon CMS versions 2.1.1 through 2.9.1 and represents a critical authenticated remote code execution flaw that can be exploited by users possessing the custom_fields manage permission. The vulnerability specifically affects the select_eval custom field type, which is designed to evaluate expressions dynamically within ERB views. When an attacker with appropriate privileges stores a malicious Ruby expression in the field options command parameter, this expression becomes executable within the web server context through the instance_eval method. The flaw stems from insufficient input validation and sanitization of user-supplied data that is subsequently processed within the application's template rendering system, creating a direct path for arbitrary code execution.
The technical implementation of this vulnerability leverages the ERB (Embedded Ruby) templating engine's evaluation mechanisms combined with Ruby's instance_eval method. When administrators or authorized users edit posts containing custom fields of the select_eval type, the application renders these fields within ERB views where the malicious expression stored in the command parameter gets evaluated through instance_eval. This process occurs server-side without proper sanitization, allowing attackers to inject and execute arbitrary Ruby code with the privileges of the web server process. The vulnerability is particularly dangerous because it requires only minimal authentication privileges rather than administrative access, making it exploitable by users who should normally have limited field management capabilities.
The operational impact of this vulnerability extends beyond simple code execution to encompass complete system compromise and data exfiltration capabilities. Attackers can leverage this vulnerability to establish persistent backdoors, escalate privileges within the application environment, or exploit additional weaknesses in the CMS infrastructure. The web server process privileges provide attackers with access to database credentials, file system resources, and potentially network connectivity to other systems within the same network segment. This vulnerability directly maps to CWE-94 (Improper Control of Generation of Code) and aligns with ATT&CK technique T1059.006 (Ruby) for execution through scripting languages. The impact is particularly severe in environments where CMS instances handle sensitive data or serve as entry points to broader network infrastructures.
Mitigation strategies should focus on immediate patching of affected Camaleon CMS versions, implementing strict input validation and sanitization for all custom field parameters, and applying principle of least privilege controls for user permissions. Organizations should review and restrict the custom_fields manage permission to only essential administrators while monitoring for unauthorized field modifications. Additional defensive measures include implementing web application firewalls with rules to detect suspicious Ruby code patterns, conducting regular security audits of custom field configurations, and establishing automated monitoring for anomalous system behavior. The vulnerability demonstrates the critical importance of validating user-supplied data in template rendering contexts and highlights the necessity of following secure coding practices that prevent dynamic code evaluation without proper sanitization mechanisms.