Is CVE-2026-66748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66748 being exploited in the wild.

How severe is CVE-2026-66748?

High severity, with a CVSS score of 8.8, published 28 July 2026.

Which products and versions are affected?

owen2345 Camaleon CMS 2.1.1 - 2.9.1.

Is there a fix for CVE-2026-66748?

A patch was published on 2026-05-01: Version 2.9.2 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66748 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-66748?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66748: Camaleon CMS remote code execution in select_eval custom field

CVE-2026-66748 · Severity: high · CVSS 8.8 · Published 2026-07-28

Camaleon CMS, a content management system built on Ruby on Rails, contains a security flaw that allows authorized users with specific permissions to execute malicious code on the server. By exploiting a specific custom field type, an attacker can run commands with the same privileges as the web server, potentially leading to a full system takeover or theft of sensitive data. This vulnerability requires the attacker to have an account with permissions to manage custom fields.

Quick answers

Is CVE-2026-66748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66748 being exploited in the wild.
How severe is CVE-2026-66748?: High severity, with a CVSS score of 8.8, published 28 July 2026.
Which products and versions are affected?: owen2345 Camaleon CMS 2.1.1 - 2.9.1.
Is there a fix for CVE-2026-66748?: A patch was published on 2026-05-01: Version 2.9.2 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66748 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-66748?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated remote code execution (RCE) vulnerability exists in Camaleon CMS (v2.1.1-2.9.1) due to improper input validation in the 'select_eval' custom field type. Users with 'custom_fields' management permissions can inject arbitrary Ruby expressions into the 'field options command' parameter. This input is subsequently executed via 'instance_eval' within an ERB view when a post edit page is rendered. An attacker can leverage this to achieve server-side code execution with the privileges of the web server process. The issue is addressed in version 2.9.2 by introducing granular permissions for 'select_eval' and restricting its use to authorized administrators.

Affected products

owen2345 Camaleon CMS 2.1.1 - 2.9.1

Timeline

2026-03-29: disclosed: Initial fix development started via pull request
2026-05-01: patched: Version 2.9.2 released with security fixes
2026-07-28: advisory: CVE-2026-66748 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.