CVE-2026-73330 Overview
CVE-2026-73330 is a server-side template injection vulnerability in CamaleonCMS 2.9.1. The flaw resides in the test_email action within the admin settings interface. Authenticated administrators can embed Embedded Ruby (ERB) tags in the email parameter, which are evaluated when an SMTP rejection reflects the recipient address back through an exception message rendered as an inline ERB template. Successful exploitation results in arbitrary Ruby code execution and operating system command execution as the Rails process user. The weakness is classified under [CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine].
Critical Impact
Authenticated administrators can achieve arbitrary command execution on the underlying host by injecting ERB expressions into the test_email endpoint.
Affected Products
- CamaleonCMS 2.9.1
- Rails applications embedding the vulnerable CamaleonCMS admin settings component
- Deployments exposing the test_email administrative action
Discovery Timeline
- 2026-08-12 - CVE-2026-73330 published to the National Vulnerability Database
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-73330
Vulnerability Analysis
The vulnerability stems from unsafe handling of user-controlled input within the admin test_email action. When an administrator submits a test email through the settings interface, CamaleonCMS forwards the recipient address to the SMTP subsystem. If the SMTP server rejects the address, the resulting exception message reflects the attacker-controlled string. That message is then rendered through the Rails inline ERB template renderer, causing embedded <%= %> expressions to be evaluated as Ruby code.
Because ERB expressions are executed in the context of the Rails process, attackers can invoke Ruby standard library methods such as backticks or system to run operating system commands. The impact extends to full read and write access to the application's data and any file system resources accessible to the Rails user account.
Exploitation requires authenticated administrator privileges, which raises the access threshold but does not prevent abuse in scenarios where administrator credentials are phished, reused, or leaked.
Root Cause
The root cause is the composition of untrusted input into a template string that is subsequently passed to the Rails inline template renderer. The renderer treats the string as an ERB template rather than a plain error message. Proper output encoding or use of a non-templating logging path would prevent evaluation of injected tags.
Attack Vector
An authenticated administrator sends an HTTP POST request to the admin settings test_email endpoint with an email parameter containing ERB syntax such as <%= ... %>. The SMTP layer rejects the malformed address and raises an exception embedding the raw input. CamaleonCMS renders the exception via the Rails inline template renderer, at which point the ERB tags execute. See the VulnCheck advisory on CamaleonCMS template injection for technical details.
Detection Methods for CVE-2026-73330
Indicators of Compromise
- HTTP POST requests to the admin test_email endpoint containing <%, %>, or URL-encoded equivalents in the email parameter
- Unexpected child processes spawned by the Rails application user, such as sh, bash, curl, or wget
- Rails production logs showing ActionView::Template::Error or SMTP exception traces referencing crafted email parameter values
- Outbound network connections from the Rails host to attacker-controlled infrastructure following administrator settings activity
Detection Strategies
- Inspect web server and Rails logs for test_email requests where the email parameter fails standard RFC 5322 syntax validation
- Alert on Ruby or Rails processes executing shell interpreters or performing file writes outside the application directory
- Correlate administrator authentication events with subsequent test_email calls to flag anomalous administrative activity
Monitoring Recommendations
- Ingest CamaleonCMS application logs into a centralized analytics platform and retain them long enough to support retrospective investigation
- Monitor process lineage on Rails hosts to detect templating engines spawning system utilities
- Track outbound egress from application servers and alert on unexpected destinations
How to Mitigate CVE-2026-73330
Immediate Actions Required
- Restrict access to the CamaleonCMS admin interface using network controls, VPN, or IP allow-listing
- Rotate administrator credentials and enforce multi-factor authentication on all admin accounts
- Audit recent use of the test_email action and review associated logs for signs of exploitation
- Monitor the CamaleonCMS GitHub repository for an upstream patch and apply it once released
Patch Information
At the time of publication, no fixed version is listed in the NVD entry for CVE-2026-73330. Administrators should track the VulnCheck advisory and the upstream project for remediation guidance. A proper fix requires ensuring that untrusted input reflected through SMTP exception messages is not passed to the Rails inline ERB renderer.
Workarounds
- Disable or remove the test_email admin action until a vendor patch is available
- Add server-side validation that rejects email parameter values containing <% or %> sequences before they reach the SMTP layer
- Configure the SMTP subsystem to sanitize exception messages so recipient input is not reflected verbatim
- Run the Rails process under a least-privilege user account to limit the blast radius of any successful exploitation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
