Thomas Wells

**Name of the Vulnerable Software and Affected Versions** Camaleon CMS versions 2.1.1 through 2.9.1 **Description** An authenticated remote code execution issue exists where users with `custom fields` manage permissions can execute arbitrary Ruby code. This occurs when a malicious expression is supplied through the `select eval` custom field type. An attacker can store a controlled Ruby expression in the `command` parameter of the field options, which is then evaluated via the `instance eval()` function within an ERB view during the rendering of a post edit page. This allows for server-side code execution with the privileges of the web server process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.