CVE-2026-73330 CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action
Authenticated administrators can execute arbitrary commands via Server-Side Template Injection in the test_email action of CamaleonCMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73330?
CVE-2026-73330 is a high-severity code injection vulnerability in owen2345 CamaleonCMS, published on 12 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.
Weakness: CWE-1336
Which versions are affected by CVE-2026-73330?
How do I fix CVE-2026-73330?
No fix has been published for CVE-2026-73330 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-73330 being exploited?
There is no known exploitation of CVE-2026-73330 in the wild and no public exploit code.
Sources
Also known as GHSA-xgmr-hcvf-x3qc.