Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck

CVE-2026-73330CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action

Medium 6.6

In plain English

A medium-severity security flaw in CamaleonCMS from owen2345. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.8%top 43.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.

Affected products (as reported)

Vendor	Product	Versions
owen2345	CamaleonCMS	0 – through 2.9.1

Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Product Repository product, patch
Blog Post product
https://www.vulncheck.com/advisories/camaleoncms-server-side-template-injection-via-test-email-action third-party-advisory