CVE-2026-66748

{
  "id": "CVE-2026-66748",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-28T16:20:16.310",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges."
    },
    {
      "lang": "es",
      "value": "Las versiones 2.1.1 a 2.9.1 de Camaleon CMS contienen una vulnerabilidad de ejecución remota de código autenticada que permite a los usuarios con permiso de gestión de campos personalizados (’custom_fields manage’) ejecutar código Ruby arbitrario al proporcionar una expresión maliciosa a través del tipo de campo personalizado ’select_eval’. Los atacantes pueden almacenar una expresión Ruby controlada por el atacante en el parámetro de comando de las opciones del campo, la cual es evaluada mediante ’instance_eval’ dentro de una vista ERB cada vez que se renderiza una página de edición de publicación, logrando la ejecución de código del lado del servidor con privilegios de proceso del servidor web."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "owen2345",
          "product": "camaleon-cms",
          "defaultStatus": "affected",
          "repo": "https://github.com/owen2345/camaleon-cms",
          "packageURL": "pkg:github/owen2345/camaleon-cms",
          "versions": [
            {
              "version": "2.1.1",
              "lessThanOrEqual": "2.9.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.9.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T19:26:54.447170Z",
          "id": "CVE-2026-66748",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/owen2345/camaleon-cms/commit/158823668e2e5c3114a69b34cf1c96cb41533c5f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/owen2345/camaleon-cms/pull/1136",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/theopaid/Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field",
      "source": "[email protected]"
    },
    {
      "url": "https://tpaidakis.com/writeups/camaleon-cms-rce-select-eval/",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/camaleon-cms-authenticated-rce-via-select-eval-custom-field",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/theopaid/Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}