CVE-2026-73331: CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field
CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73331?
CVE-2026-73331 has a severity rating of high with a score of 7.1.
How do I fix CVE-2026-73331?
To fix CVE-2026-73331, ensure that CamaleonCMS is updated to a version that addresses the authenticated SQL injection vulnerability.
Who is affected by CVE-2026-73331?
CVE-2026-73331 affects authenticated users with post creation or editing privileges in CamaleonCMS 2.9.1.
What types of attacks can be performed using CVE-2026-73331?
CVE-2026-73331 allows authenticated attackers to execute SQL injection attacks via a crafted post slug, compromising database integrity.
What components are involved in CVE-2026-73331?
CVE-2026-73331 involves the post slug field in CamaleonCMS 2.9.1, where inadequate parameterization leads to an SQL injection vulnerability.