CamaleonCMS CVE-2026-73329

Exploitation requires an authenticated account with at least low privileges (PR:L) able to reach the drafts creation endpoint and submit a post title, plus the specific product feature of unsanitized draft-title storage and the admin drafts listing view being the rendering sink. It is limited by user interaction (UI:A): an administrator must load the admin drafts listing page for the stored payload to execute, so it is not fully autonomous. There is no unauthenticated path - a low-privileged foothold in the CamaleonCMS admin/content area is a hard prerequisite, and exploitation depends on at least one privileged user viewing the drafts screen.

The CVSS 4.0 score of 9.2 (Critical) reflects network attack vector (AV:N), low complexity (AC:L), only low privileges required (PR:L), and a scope/subsequent-system impact (SC:H/SI:H) representing the pivot into the admin's context - but it is tempered by UI:A, meaning an administrator must actually view the drafts page for the payload to fire. There is no EPSS score provided and no CISA KEV listing, so there is no evidence of active exploitation; the risk is real but conditional on both a low-privileged foothold and admin interaction. A detailed public write-up exists (enrik-m blog and VulnCheck advisory), which lowers the bar to reproduce even though formal exploit code is not confirmed. Net assessment: a genuine, high-value privilege-escalation vector in any multi-user CamaleonCMS deployment, not merely an inflated high-CVSS score, though real-world exploitation is targeted (insider/low-priv-to-admin) rather than mass, internet-scale automatable.

A low-privileged authenticated user (e.g., a contributor account) submits a draft whose title contains a script payload such as an image tag with an onerror handler through the drafts creation endpoint. The payload is stored unescaped and executes automatically the next time an administrator opens the admin drafts listing, exfiltrating the admin's session cookie or issuing forged administrative actions. A public technical write-up describing the exact endpoint and sink exists, lowering the effort to reproduce, though no packaged exploit is confirmed.