CVE-2026-66748: Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instanceeval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66748?
CVE-2026-66748 has a severity rating of 8.7, categorized as high.
How do I fix CVE-2026-66748?
To fix CVE-2026-66748, upgrade Camaleon CMS to version 2.9.2 or later.
Who is affected by CVE-2026-66748?
CVE-2026-66748 affects users of Camaleon CMS versions 2.1.1 through 2.9.1 with custom_fields manage permissions.
What type of vulnerability is CVE-2026-66748?
CVE-2026-66748 is a code injection vulnerability that allows for authenticated remote code execution.
What can an attacker do with CVE-2026-66748?
An attacker can execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type.