CVE-2026-66748

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions 2.1.1 through 2.9.1

Description An authenticated remote code execution issue exists where users with custom fields manage permissions can execute arbitrary Ruby code. This occurs when a malicious expression is supplied through the select eval custom field type. An attacker can store a controlled Ruby expression in the command parameter of the field options, which is then evaluated via the instance eval() function within an ERB view during the rendering of a post edit page. This allows for server-side code execution with the privileges of the web server process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.