Camaleon CMS CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Camaleon CMS CVE published 2026-07-28

CVE-2026-66748

CVE-2026-66748 is an authenticated remote code execution vulnerability in Camaleon CMS versions 2.1.1 through 2.9.1. The vulnerability exists in the select_eval custom field type, allowing users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the field options command parameter. This code is evaluated via instance_eval within an ERB view when [truncated]

MEDIUM Camaleon CMS CVE published 2026-06-12

CVE-2026-10715

CVE-2026-10715 is an improper authorization vulnerability in Camaleon CMS 2.9.2. A low-privileged authenticated user can send an arbitrary post_id to POST /admin/post_type/<POST_TYPE_ID>/drafts and overwrite the draft associated with another user's post. The CVSS score for this vulnerability is 5.1, and the severity is rated as MEDIUM.