CVE-2026-73330 owen2345 CVE debrief

Who should care

Administrators and users of CamaleonCMS 2.9.1, especially those with authenticated administrator access, should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes patching CamaleonCMS 2.9.1 instances, restricting access to the test_email settings action, monitoring for suspicious activity on affected systems, verifying and limiting administrator accounts and privileges, and reviewing compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The CVE-2026-73330 vulnerability in CamaleonCMS 2.9.1 allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action. This is due to the evaluation of attacker-controlled Ruby code by the Rails inline template renderer when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit crafted email parameters containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user. To address this vulnerability, prioritize patching CamaleonCMS 2.9.1 instances, especially those exposed to authenticated administrators, to prevent potential arbitrary command execution.

Defensive priority

Administrators should prioritize patching CamaleonCMS 2.9.1 instances, especially those exposed to authenticated administrators, to prevent potential arbitrary command execution.

Recommended defensive actions

• Patch CamaleonCMS 2.9.1 to prevent arbitrary command execution
• Restrict access to the test_email settings action
• Monitor for suspicious activity on affected systems
• Verify and limit administrator accounts and privileges
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-73330 record indicates a server-side template injection vulnerability in CamaleonCMS 2.9.1, allowing authenticated administrators to execute arbitrary commands via ERB tags in the email parameter of the test_email settings action. Evidence is based on official CVE and NVD records, as well as references from Vulncheck and other sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.