CVE-2026-73330: fallo de gravedad alta en owen2345 CamaleonCMS
CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.8%
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
owen2345 · CamaleonCMSCVEs relacionadas — owen2345 CamaleonCMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-56721HIGHCamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersControllerEPSS 0.5%CVE-2026-73332CRITICALCamaleonCMS cama_contact_form Plugin Stored XSS via before_html FieldEPSS 0.4%CVE-2026-73329CRITICALCamaleonCMS Stored XSS via Draft Post Title Creation EndpointEPSS 0.4%CVE-2026-73326HIGHCamaleonCMS Missing Authorization via Plugin Administration EndpointsEPSS 0.4%CVE-2026-73331HIGHCamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug FieldEPSS 0.4%CVE-2026-56720MEDIUMCamaleonCMS 2.9.2 and earlier Missing Authorization via profile ActionEPSS 0.3%