Authenticated Remote Code Execution in Camaleon CMS

CVE-2026-66748 details an authenticated remote code execution vulnerability affecting Camaleon CMS versions 2.1.1 through 2.9.1. An attacker with specific administrative permissions, namely "custom_fields manage," can leverage this flaw to execute arbitrary Ruby code on the compromised server. This is achieved by injecting a crafted Ruby expression into the "options command" parameter of a select_eval custom field type. When a user subsequently renders a post edit page that incorporates this malicious custom field, the embedded Ruby code is evaluated using instance_eval within an ERB view, resulting in server-side code execution under the privileges of the web server process. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected CMS instances.

Attack Chain

1. An attacker obtains authentication credentials for Camaleon CMS with sufficient privileges, including the custom_fields manage permission.
2. The attacker navigates to the custom field configuration interface within the Camaleon CMS administration panel.
3. The attacker creates a new select_eval custom field or modifies an existing one.
4. Within the configuration for the select_eval custom field, the attacker injects a malicious Ruby expression into the options command parameter.
5. The Camaleon CMS backend persists this malicious Ruby expression within its database.
6. Subsequently, an authorized user (potentially the attacker) renders a post edit page that is configured to display or utilize the specially crafted custom field.
7. During the server-side rendering of the ERB view for the post edit page, the instance_eval function processes the stored malicious Ruby expression.
8. The injected arbitrary Ruby code executes on the Camaleon CMS server with the privileges of the web server process, achieving remote code execution.

Impact

Successful exploitation of CVE-2026-66748 grants an authenticated attacker full remote code execution capabilities on the Camaleon CMS server. This can lead to complete compromise of the CMS instance, allowing for data theft, modification, or deletion, as well as the potential to establish persistent access or pivot to other systems within the network. The high CVSS v3.1 Base Score of 8.8 reflects the critical nature of this vulnerability, indicating significant impact on confidentiality, integrity, and availability of the affected system and potentially associated data.

Recommendation

• Patch Camaleon CMS installations immediately to a version beyond 2.9.1 to address CVE-2026-66748.
• Review user permissions and enforce the principle of least privilege, especially for users with custom_fields manage permissions, to mitigate the risk posed by CVE-2026-66748.
• Monitor web server access logs for unusual activity following successful authentication, specifically looking for attempts to modify custom field configurations or access select_eval fields with unusual parameters.