CVE-2026-66748
Received Received - Intake

Authenticated Remote Code Execution in Camaleon CMS via Malicious Ruby Expression

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: VulnCheck

Description
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-66748
EUVD
EUVD-2026-49871

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
camaleon_cms camaleon_cms From 2.1.1 (inc) to 2.9.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authenticated remote code execution flaw in Camaleon CMS versions 2.1.1 through 2.9.1. It allows users with the custom_fields manage permission to inject and execute arbitrary Ruby code via the select_eval custom field type. The attack involves storing malicious Ruby code in a custom field, which is then evaluated unsafely when a post edit page is rendered, granting server-side code execution with web server privileges.

Detection Guidance

Check Camaleon CMS versions between 2.1.1 and 2.9.1 using commands like 'gem list camaleon-cms' or 'bundle list | grep camaleon-cms'. Inspect custom fields for select_eval types in the admin panel. Look for unauthorized Ruby code in field options or post edit pages.

Impact Analysis

This vulnerability can lead to full server compromise, allowing attackers to execute arbitrary commands, steal data, or take control of the entire system. It enables persistent remote code execution, session forgery, and multi-site compromise on shared instances. Exploitation requires only an editor-level account, making it accessible to low-privilege users.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized code execution, potential data breaches, and loss of system integrity. It enables attackers to access, modify, or exfiltrate sensitive data, leading to regulatory penalties, legal consequences, and reputational damage.

Mitigation Strategies

Upgrade Camaleon CMS to version 2.9.2 or later immediately. Remove select_eval custom field permissions from non-admin users via User Roles UI or rake task. Review and audit all custom fields for malicious Ruby code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66748. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart