CVE-2026-73330

Received Received - Intake

Authenticated Admin Command Injection in CamaleonCMS via ERB Template Injection

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73330

EUVD

EUVD-2026-57431

Affected Vendors & Products

Vendor	Product	Version / Range
camaleoncms	camaleoncms	2.9.1
camaleoncms	camaleoncms	to 2.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

CVE-2026-73330 is a server-side template injection flaw in CamaleonCMS 2.9.1. Authenticated administrators can inject ERB (Embedded Ruby) tags into the email parameter of the test_email settings action. When an SMTP server rejects the crafted email, the error message renders the ERB tags as an inline template, executing attacker-controlled Ruby code. This leads to arbitrary command execution as the Rails process user.

Impact Analysis

This vulnerability allows attackers with admin access to execute arbitrary commands on the server. This could lead to full system compromise, data theft, or disruption of services. The impact depends on the server's configuration and the privileges of the Rails process user.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage if exploited.

Hi! I’m here to help you understand CVE-2026-73330. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70