CVE-2026-66748: Camaleon CMS Authenticated RCE Vulnerability

CVE-2026-66748 Overview

CVE-2026-66748 is an authenticated remote code execution vulnerability in Camaleon CMS versions 2.1.1 through 2.9.1. The flaw exists in the select_eval custom field type. Users holding the custom_fields manage permission can inject arbitrary Ruby expressions through the field options command parameter. The stored expression is evaluated via instance_eval inside an ERB view whenever a post edit page is rendered. Successful exploitation grants code execution with the privileges of the web server process. The vulnerability is tracked under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Authenticated attackers with custom_fields manage permission can achieve server-side Ruby code execution and full compromise of the Camaleon CMS host process.

Affected Products

Camaleon CMS 2.1.1 through 2.9.1
Camaleon CMS installations exposing the select_eval custom field type
Ruby on Rails applications embedding vulnerable Camaleon CMS gem versions

Discovery Timeline

2026-07-28 - CVE-2026-66748 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-66748

Vulnerability Analysis

Camaleon CMS ships a custom field type named select_eval that dynamically generates dropdown options by evaluating a Ruby expression stored in the field configuration. The framework passes attacker-controlled text from the field options command parameter directly to instance_eval within an ERB template. Because instance_eval executes arbitrary Ruby code in the context of the current object, any user permitted to author custom fields can store a payload that runs on the server. Rendering the post edit page triggers execution, so the payload fires each time an administrator opens the affected content.

Root Cause

The root cause is unsanitized code evaluation. The select_eval field type treats the command option as trusted Ruby source and invokes instance_eval on it during view rendering. No allowlist, sandbox, or permission check restricts the expression, so any account with the custom_fields manage permission crosses a trust boundary into arbitrary code execution.

Attack Vector

An authenticated attacker with the custom_fields manage permission navigates to the custom fields administration interface and creates or edits a field of type select_eval. The attacker sets the command option to a Ruby payload such as a shell command executor. When any user with access to a post edit page loads that page, the ERB view calls instance_eval on the payload and executes it under the web server process account.

ruby

# Security patch: app/controllers/camaleon_cms/admin_controller.rb
# Adds request-scoped state tracking used by the select_eval permission fix
     include CamaleonCms::Admin::ApplicationHelper
     # layout 'camaleon_cms/admin'
     before_action :cama_authenticate
+    before_action :keep_request_attrs
     before_action :admin_init_actions
     before_action :admin_logged_actions
     before_action :admin_before_hooks

Source: GitHub Commit 158823668e

ruby

# Security patch: app/helpers/camaleon_cms/site_helper.rb
# Propagates current site into CurrentRequest so permission checks can gate select_eval
   module SiteHelper
     # return current site or assign a site as a current site
     def current_site(site = nil)
-      @current_site = site.decorate if site.present?
-      return $current_site if defined?($current_site)
-      return @current_site if defined?(@current_site)
+      if site.present?
+        @current_site = site.decorate
+        CurrentRequest.site = @current_site
+        return @current_site
+      end
+
+      if defined?($current_site)
+        CurrentRequest.site = $current_site
+        return $current_site
+      end
+
+      if defined?(@current_site) && @current_site.present?
+        CurrentRequest.site = @current_site
+        return @current_site
+      end

Source: GitHub Commit 158823668e

Detection Methods for CVE-2026-66748

Indicators of Compromise

Custom fields of type select_eval created or modified by non-administrator accounts, especially with unusual values in the command option.
Unexpected child processes spawned by the Ruby or Rails application process, such as /bin/sh, curl, or wget, following administrative page loads.
Outbound network connections from the web server process to unfamiliar hosts shortly after a post edit page render.
New or modified files in the Camaleon CMS application root or tmp/ directory that do not correspond to legitimate deployments.

Detection Strategies

Audit the camaleon_cms_custom_fields table for rows where field_key equals select_eval and inspect the serialized options column for suspicious Ruby expressions.
Enable Rails production logging at info level and search for ERB rendering exceptions or unusual method calls originating from custom field partials.
Correlate administrative HTTP requests to /admin/custom_fields with subsequent process execution telemetry on the host.

Monitoring Recommendations

Instrument the Camaleon CMS host with process execution telemetry that flags any child process launched by the Ruby, Puma, or Passenger worker.
Alert on file integrity changes inside the application directory and on writes to system-level paths by the web server user.
Track authentication events for accounts holding the custom_fields manage permission and review usage patterns for anomalies.

How to Mitigate CVE-2026-66748

Immediate Actions Required

Upgrade Camaleon CMS to version 2.9.2 or later, which removes the unsafe evaluation path and enforces permission checks on select_eval.
Inventory existing custom fields and delete any select_eval fields whose command option is not required for legitimate site functionality.
Rotate credentials for administrative accounts and any secrets accessible from the web server process, since exploitation grants full application-context code execution.
Review web server, application, and database logs since May 2026 for evidence of custom field abuse or unexpected shell activity.

Patch Information

The fix is available in Camaleon CMS release 2.9.2. The remediation was delivered in Pull Request #1136 and commit 158823668e. Additional technical context is available in the Vulncheck Security Advisory and the Tpaidakis writeup.

Workarounds

Restrict the custom_fields manage permission to a minimal set of trusted administrators until the upgrade is applied.
Disable or remove the select_eval custom field type in application initializers if the deployment does not require it.
Place the Camaleon CMS administration interface behind network-level controls such as VPN, IP allowlisting, or a web application firewall.
Run the Ruby application process under a low-privilege system account with restricted filesystem and network access.

bash

# Upgrade Camaleon CMS in a Rails application Gemfile
# Replace the current version constraint and reinstall
sed -i "s/gem 'camaleon_cms'.*/gem 'camaleon_cms', '>= 2.9.2'/" Gemfile
bundle update camaleon_cms
bundle exec rails db:migrate
bundle exec rails restart