EUVD-2026-57431
GHSA-xgmr-hcvf-x3qc
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V1 - Encoding and Sanitization Template injection prevention
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 12, 2026
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote code execution by embedding ERB expressions in the email parameter of the admin test_email endpoint. When SMTP rejects the crafted recipient address, Rails renders the rejection exception message as an inline ERB template, evaluating attacker-controlled Ruby code as the Rails process user. A patch is available from the vendor; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.5 reflects high confidentiality, integrity, and availability impact constrained by the admin-only prerequisite and the SMTP-rejection triggering condition.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Camaleoncms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.
Executive ViewAI
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary code on the web server, enabling complete system compromise. Organizations using this CMS face operational and data security risk if administrator accounts are compromised or internal threats exploit this capability to alter configurations or exfiltrate data. A vendor patch is available and should be prioritized for immediate deployment.
Within 24 hours, conduct an inventory of all systems running CamaleonCMS 2.9.1 and audit administrator access logs, focusing on any use of the email testing functionality and configuration changes within the past 90 days. Within 7 days, apply the vendor-released patch to all affected CamaleonCMS 2.9.1 instances per vendor advisory and validate successful patching on each system. Within 30 days, review and restrict administrator role assignments to align with principle of least privilege, require multi-factor authentication for all administrative accounts, and rerun vulnerability scans to confirm remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Camaleoncms
View allStored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist a
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a m
Privilege escalation in CamaleonCMS 2.9.2 and earlier allows any authenticated low-privileged user to overwrite administ
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag,
Authenticated SQL injection in CamaleonCMS 2.9.1 allows low-privileged users holding post creation or editing rights to
Insecure Direct Object Reference in CamaleonCMS 2.9.2 and earlier allows any authenticated user to enumerate and read pr
Server-side request forgery in Camaleon CMS 2.7.5-2.9.1 allows authenticated users to abuse the media library's 'Upload
Exploit-DB