CVE-2026-66748

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66748", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-27T16:27:47.648Z", "datePublished": "2026-07-28T15:19:52.609Z", "dateUpdated": "2026-11-08T14:08:06.902Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:08:06.902Z"}, "datePublic": "2026-04-05T00:00:00.000Z", "title": "Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field", "descriptions": [{"lang": "en", "value": "Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges."}], "tags": ["x_open-source"], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "affected": [{"defaultStatus": "affected", "vendor": "owen2345", "product": "camaleon-cms", "packageURL": "pkg:github/owen2345/camaleon-cms", "repo": "https://github.com/owen2345/camaleon-cms", "versions": [{"status": "affected", "version": "2.1.1", "versionType": "semver", "lessThanOrEqual": "2.9.1"}, {"status": "affected", "version": "2.9.2", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.1.1", "versionEndIncluding": "2.9.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:tuzitio:camaleon_cms:2.9.2:*:*:*:*:*:*:*"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "references": [{"url": "https://tpaidakis.com/writeups/camaleon-cms-rce-select-eval/", "name": "Researcher Blog (Theodosis Paidakis)", "tags": ["technical-description", "exploit"]}, {"url": "https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/", "name": "Researcher Blog (Enrik Mustafa)", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/theopaid/Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field", "name": "Researcher Disclosure (Theodosis Paidakis)", "tags": ["exploit", "technical-description"]}, {"url": "https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2", "name": "camaleon-cms 2.9.2 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/owen2345/camaleon-cms/pull/1136", "tags": ["issue-tracking", "patch"], "name": "Pull Request"}, {"url": "https://github.com/owen2345/camaleon-cms/commit/158823668e2e5c3114a69b34cf1c96cb41533c5f", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://www.vulncheck.com/advisories/camaleon-cms-authenticated-rce-via-select-eval-custom-field", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Theodosis Paidakis", "type": "finder"}, {"lang": "en", "value": "Ik0nw", "type": "finder"}, {"lang": "en", "value": "Thomas Wells", "type": "finder"}, {"lang": "en", "value": "Amir Aliu & Enrik Mustafa", "type": "finder"}, {"lang": "en", "value": "l1nk", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"references": [{"url": "https://github.com/theopaid/Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T19:26:54.447170Z", "id": "CVE-2026-66748", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T19:27:14.879Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66748", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T19:26:54.447170Z"}}}], "references": [{"url": "https://github.com/theopaid/Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T19:27:09.949Z"}}], "cna": {"tags": ["x_open-source"], "title": "Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Theodosis Paidakis"}, {"lang": "en", "type": "finder", "value": "Ik0nw"}, {"lang": "en", "type": "finder", "value": "Thomas Wells"}, {"lang": "en", "type": "finder", "value": "Amir Aliu & Enrik Mustafa"}, {"lang": "en", "type": "finder", "value": "l1nk"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/owen2345/camaleon-cms", "vendor": "owen2345", "product": "camaleon-cms", "versions": [{"status": "affected", "version": "2.1.1", "versionType": "semver", "lessThanOrEqual": "2.9.1"}, {"status": "affected", "version": "2.9.2", "versionType": "semver"}], "packageURL": "pkg:github/owen2345/camaleon-cms", "defaultStatus": "affected"}], "datePublic": "2026-04-05T00:00:00.000Z", "references": [{"url": "https://tpaidakis.com/writeups/camaleon-cms-rce-select-eval/", "name": "Researcher Blog (Theodosis Paidakis)", "tags": ["technical-description", "exploit"]}, {"url": "https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/", "name": "Researcher Blog (Enrik Mustafa)", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/theopaid/Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field", "name": "Researcher Disclosure (Theodosis Paidakis)", "tags": ["exploit", "technical-description"]}, {"url": "https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2", "name": "camaleon-cms 2.9.2 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/owen2345/camaleon-cms/pull/1136", "name": "Pull Request", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/owen2345/camaleon-cms/commit/158823668e2e5c3114a69b34cf1c96cb41533c5f", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/camaleon-cms-authenticated-rce-via-select-eval-custom-field", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.9.1", "versionStartIncluding": "2.1.1"}, {"criteria": "cpe:2.3:a:tuzitio:camaleon_cms:2.9.2:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:08:06.902Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66748", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:08:06.902Z", "dateReserved": "2026-07-27T16:27:47.648Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-28T15:19:52.609Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageURL": "pkg:github/owen2345/camaleon-cms", "product": "camaleon-cms", "repo": "https://github.com/owen2345/camaleon-cms", "vendor": "owen2345", "versions": [{"lessThanOrEqual": "2.9.1", "status": "affected", "version": "2.1.1", "versionType": "semver"}, {"status": "affected", "version": "2.9.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges."}, {"lang": "es", "value": "Las versiones 2.1.1 a 2.9.1 de Camaleon CMS contienen una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo autenticada que permite a los usuarios con permiso de gesti\u00f3n de campos personalizados (\u2019custom_fields manage\u2019) ejecutar c\u00f3digo Ruby arbitrario al proporcionar una expresi\u00f3n maliciosa a trav\u00e9s del tipo de campo personalizado \u2019select_eval\u2019. Los atacantes pueden almacenar una expresi\u00f3n Ruby controlada por el atacante en el par\u00e1metro de comando de las opciones del campo, la cual es evaluada mediante \u2019instance_eval\u2019 dentro de una vista ERB cada vez que se renderiza una p\u00e1gina de edici\u00f3n de publicaci\u00f3n, logrando la ejecuci\u00f3n de c\u00f3digo del lado del servidor con privilegios de proceso del servidor web."}], "id": "CVE-2026-66748", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66748", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T19:26:54.447170Z", "version": "2.0.3"}}]}, "published": "2026-07-28T16:20:16.310", "references": [{"source": "disclosure@vulncheck.com", "url": "https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/owen2345/camaleon-cms/commit/158823668e2e5c3114a69b34cf1c96cb41533c5f"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/owen2345/camaleon-cms/pull/1136"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/theopaid/Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field"}, {"source": "disclosure@vulncheck.com", "url": "https://tpaidakis.com/writeups/camaleon-cms-rce-select-eval/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/camaleon-cms-authenticated-rce-via-select-eval-custom-field"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/theopaid/Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.1.1,2.9.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.9.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "camaleon-cms", "source": "cna", "vendor": "owen2345"}, "product": "camaleon_cms", "vendor": "owen2345"}], "created": "2026-07-28T18:45:12.277186+00:00", "updated": "2026-08-03T15:00:15.934373+00:00", "vendors": ["owen2345", "owen2345$PRODUCT$camaleon_cms"]}