CVE-2026-73330

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/#44-stored-xss-via-draft-post-title
https://github.com/owen2345/camaleon-cms
https://www.vulncheck.com/advisories/camaleoncms-server-side-template-injection-via-test-email-action

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) CamaleonCMS 2.9.1 contiene una vulnerabilidad de inyección de plantillas del lado del servidor que permite a los administradores autenticados ejecutar comyos arbitrarios incrustyo etiquetas ERB en el parámetro email de la acción de configuración test_email, las cuales son evaluadas cuyo un rechazo SMTP refleja la dirección del destinatario de vuelta en el mensaje de excepción renderizado como una plantilla ERB en línea. Los atacantes pueden enviar un parámetro email manipulado que contiene expresiones ERB a través del endpoint test_email de la configuración de administrador, causyo que el renderizador de plantillas en línea de Rails evalúe código Rupor controlado por el atacante y lograr la ejecución de comyos arbitrarios como el usuario del proceso de Rails.

Information

Published : 2026-08-12 20:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73330

Mitre link : CVE-2026-73330

CVE.ORG link : CVE-2026-73330

JSON object : View

Products Affected

No product.

CWE

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-73330", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73330", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T19:46:36.307436Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "owen2345", "product": "CamaleonCMS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.9.1"}], "defaultStatus": "affected"}]}], "published": "2026-08-12T20:17:55.197", "references": [{"url": "https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/#44-stored-xss-via-draft-post-title", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/owen2345/camaleon-cms", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/camaleoncms-server-side-template-injection-via-test-email-action", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user."}, {"lang": "es", "value": "CamaleonCMS 2.9.1 contiene una vulnerabilidad de inyecci\u00f3n de plantillas del lado del servidor que permite a los administradores autenticados ejecutar comyos arbitrarios incrustyo etiquetas ERB en el par\u00e1metro email de la acci\u00f3n de configuraci\u00f3n test_email, las cuales son evaluadas cuyo un rechazo SMTP refleja la direcci\u00f3n del destinatario de vuelta en el mensaje de excepci\u00f3n renderizado como una plantilla ERB en l\u00ednea. Los atacantes pueden enviar un par\u00e1metro email manipulado que contiene expresiones ERB a trav\u00e9s del endpoint test_email de la configuraci\u00f3n de administrador, causyo que el renderizador de plantillas en l\u00ednea de Rails eval\u00fae c\u00f3digo Rupor controlado por el atacante y lograr la ejecuci\u00f3n de comyos arbitrarios como el usuario del proceso de Rails."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}