Camaleon Cms EUVD-2026-49871

We need to produce a JSON object with the specified fields. All fields are plain text strings. The input includes CVE-2026-66748 description, CVSS 4.0 vector (base only, no temporal/environmental), CWE-94, tags, POC publicly available, Patch available from vendor, CPE, SSVC, references, release notes with more details. Need to synthesize.

Key points from description: Camaleon CMS versions 2.1.1 through 2.9.1, authenticated remote code execution, users with custom_fields manage permission can execute arbitrary Ruby code via select_eval custom field type. They supply a malicious expression in the field options command parameter, evaluated via instance_eval in ERB view when post edit page is rendered, achieving code execution with web process privileges.

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. This is a v4 vector. Note the PR:L (low privileges). So authenticated as low privilege? Description says "users with custom_fields manage permission" - that's a specific permission, might be low or high? Typically custom_fields manage is not admin-level, maybe low. PR:L is consistent. AC:L, AV:N, UI:N. Total technical impact. So high CVSS 8.7 (not sure if that's computed score or base? CVSS 4.0 base score with those metrics would be 9.3? Wait, the given score is 8.7, maybe includes some environmental? But vector does not have environmental. Let's compute: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N -> base score: impact subscore: VC,H=0.56? Actually CVSS 4.0 formula: base score = max( ( (Impact_subscore * Exploitability_subscore)^? No, need to recall. But not necessary, just given score. We'll assess our own vector (both 3.1 and 4.0) based on description.

Key: Authentication required (PR:L). Exploitation requires custom_fields manage permission (PR:L). The vulnerability is in how select_eval custom field type is evaluated. This field type was meant for advanced usage, but now they restrict it with a new permission. So prior to 2