CVE-2026-73330

Katalog CVE

CVSS 6.6 · Medium EPSS 0,79%

Kerentanan Improper Neutralization of Special Elements Used in a Template Engine. Skor CVSS 3.1 6.6 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.

Rincian

Terbit di NVD

12 Agustus 2026

Terakhir diubah

26 Agustus 2026

Status NVD

Deferred

CVSS 3.1

6.6 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/#44-stored-xss-via-draft-post-title
• https://github.com/owen2345/camaleon-cms
• https://www.vulncheck.com/advisories/camaleoncms-server-side-template-injection-via-test-email-action