CVE-2026-73332 in CamaleonCMS
Summary
by MITRE • 08/12/2026
CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper authorization controls. Attackers can persist malicious script payloads into the database that execute in victims' browsers when the contact form loads, enabling cookie theft, forged authenticated requests against the admin interface, and session takeover of viewing users.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The CamaleonCMS platform presents a critical stored cross-site scripting vulnerability within its cama_contact_form plugin that represents a significant security weakness for organizations relying on this content management system. This vulnerability specifically affects the contact form editing functionality where attackers can manipulate the before_html field through the contact form edit endpoint without proper input sanitization or authorization verification mechanisms. The flaw exists in the plugin's handling of user-supplied data, creating a persistent XSS vector that allows malicious actors to inject arbitrary HTML code into the system's database. The vulnerability is particularly concerning because it requires only low-privileged authenticated access, meaning that users with minimal permissions can exploit this weakness to compromise the entire system.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization practices within the contact form plugin's backend processing logic. When administrators or authorized users edit contact forms through the web interface, the before_html field accepts raw HTML content without proper encoding or filtering mechanisms that would prevent malicious script injection. This lack of proper authorization controls at the endpoint level allows attackers to submit crafted payloads that bypass standard security measures designed to protect against cross-site scripting attacks. The vulnerability manifests as a stored XSS condition because the malicious code is permanently saved in the database and executed whenever the contact form is rendered, making it particularly dangerous for long-term persistence.
The operational impact of this vulnerability extends far beyond simple script execution, creating multiple attack vectors that can be leveraged by threat actors to escalate privileges and compromise system integrity. When victims browse pages containing the compromised contact form, their browsers execute the injected scripts which can perform various malicious activities including stealing session cookies, capturing user credentials, or executing forged authenticated requests against the CMS administration interface. This capability enables attackers to hijack user sessions, gain unauthorized access to administrative functions, and potentially take complete control of the CMS platform. The vulnerability's persistence through database storage means that even if the initial attack is detected and the system is restarted, the malicious code remains active until manually removed.
Organizations utilizing CamaleonCMS must implement immediate mitigations to address this stored XSS vulnerability while also considering broader security improvements to prevent similar issues in other components. The most effective immediate fix involves implementing comprehensive input sanitization and output encoding mechanisms that strip or encode potentially dangerous HTML characters before storing user content in the database. Additionally, proper authorization controls should be enforced at all endpoints where users can modify system configurations or content, ensuring that only appropriately privileged users can access sensitive editing functions. This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and maps to ATT&CK technique T1059.006 for scripting languages and T1548.003 for abuse of privileges, demonstrating how this weakness can be exploited to establish persistent access and escalate system compromise.
Security teams should implement comprehensive monitoring and logging of contact form editing activities to detect potential exploitation attempts, while also conducting regular security assessments of all CMS plugins and extensions to identify similar vulnerabilities that may exist in other components. The remediation process must include thorough code reviews of the cama_contact_form plugin to ensure proper input validation, output encoding, and authorization controls are implemented throughout all user-facing interfaces. Organizations should also consider implementing web application firewalls with XSS detection capabilities as an additional defensive layer, though this should not replace proper code-level fixes. Regular security updates and patch management processes should be enforced to ensure that known vulnerabilities in CMS platforms and their plugins are promptly addressed through official vendor releases or community-developed patches.