Camaleon CMS CVE-2026-66748

Requires an authenticated account that has been granted the 'custom_fields manage' permission (in versions ≤2.9.1 the select_eval field type is not gated by a dedicated permission). The attacker must be able to create/edit a select_eval custom field and set its field options 'command' parameter; code execution fires when a post edit page containing that field is rendered (instance_eval within an ERB view). Limiting factors: exploitation is impossible without the manage permission (not exposed to anonymous/unauthenticated users), and the fix (2.9.2, PR #1136) adds an explicit 'select_eval' permission plus model-layer authorization so that only admins or explicitly-granted roles can use the field type. Not exploitable against default configurations where untrusted users lack custom-field management rights.

This is a genuine but access-gated code-execution flaw rather than a mass-exploitation crisis. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC/VI/VA:H, base 8.7) is internally consistent with the description: network-reachable, low complexity, but requiring low privileges (PR:L) because the attacker must hold the 'custom_fields manage' permission - this is an authenticated, privileged-user attack, not a drive-by. SSVC reinforces a measured priority: Exploitation=poc (not 'active'), Automatable=no (a valid account with a specific permission is a precondition that resists mass automation), Technical Impact=total (full RCE once triggered). EPSS is 0.74% at the 51st percentile - low absolute probability, consistent with a POC-but-not-widely-weaponized posture. There is NO CISA KEV listing and NO evidence of active exploitation. Public exploit code exists (theopaid PoC on GitHub plus two independent write-ups), so weaponization potential is real and the barrier to reproduction is low for anyone with the required account. Net: prioritize patching where Camaleon CMS grants non-admin users custom-field management, but treat this as an insider/privilege-escalation-chain risk (total impact behind a permission gate) rather than an unauthenticated internet-facing emergency. Signals are consistent, not conflicting.

An attacker who holds (or has compromised) a Camaleon CMS account with the 'custom_fields manage' permission creates a select_eval custom field and stores a malicious Ruby expression in the field options 'command' parameter. When any post edit page bearing that field is rendered, the expression is evaluated via instance_eval inside an ERB view, running arbitrary Ruby as the web server process. A public PoC and multiple write-ups exist, so reproduction requires minimal skill once a suitable account is obtained.