Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · unedited
Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidence
Camaleon CMS versions 2.1.1-2.9.1 have an authenticated RCE vulnerability in the select_eval custom field type. Users with custom_fields manage permission can store malicious Ruby expressions in the 'command' field options parameter, which gets evaluated via instance_eval in an ERB view whenever a post edit page is rendered, allowing arbitrary code execution with web server privileges.
MitigationUpgrade to Camaleon CMS version 2.9.2 or later, or disable the select_eval custom field type for users without administrative privileges until patching is possible.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checks
Work through these to decide whether this CVE applies to you.
Confirm Camaleon CMS installation and version
Locate the Gemfile or version.rb file in the Rails application root and check the camaleon_cms gem version. Alternatively, check the admin dashboard footer for the version number.
Affected if The installed version falls within 2.1.1 to 2.9.1 inclusive.
Identify users with custom_fields manage permission
Access the admin panel, navigate to Roles/Permissions settings, and list all roles that have the 'custom_fields' manage permission enabled. Cross-reference with the Users section to see which non-admin users are assigned those roles.
Affected if Any non-admin user account has custom_fields manage permission assigned.
Inspect select_eval custom field configurations
In the admin panel, go to Custom Fields settings and examine any custom field definitions. Look for fields where the field type is set to 'select_eval' and inspect the 'command' parameter value.
Affected if A custom field with type 'select_eval' exists and contains suspicious Ruby code in the command parameter.
Review application database for malicious field data
Query the custom_fields or similar database table where field configurations are stored. Look for records where field_type='select_eval' and the command/options column contains Ruby method calls like system, exec, eval, or backtick operators.
Affected if Database records contain Ruby code in select_eval field configurations that could execute system commands.
Check for unexpected code execution in view logs
Review Rails logs (production.log or development.log) around the time post edit pages were rendered. Look for instance_eval calls or unexpected method executions that correspond to custom field rendering.
Affected if Logs show instance_eval being called on custom field data, indicating the vulnerability may have been triggered.
A Camaleon CMS installation is affected if it runs version 2.1.1-2.9.1 AND has any non-admin user with custom_fields manage permission, particularly if select_eval custom fields are configured.
Generated from the published advisory. Verify against your own configuration.
Check your environment
Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.
AI-assisted, checked against the advisory. Informational, not a guarantee.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped
Mitigation availableNo clean upgrade yet — mitigate in the meantime
Mitigation
Upgrade to Camaleon CMS version 2.9.2 or later, or disable the select_eval custom field type for users without administrative privileges until patching is possible.
Recommended fixModerate confidence
Upgrade to Camaleon CMS version 2.9.2 or later
1. Backup your Camaleon CMS database and application files before proceeding.
2. Locate your Gemfile or gemspec file in the Camaleon CMS application directory.
3. Update the camaleon_cms gem version constraint to require version 2.9.2 or later: change gem 'camaleon_cms', '~> 2.9.0' to gem 'camaleon_cms', '~> 2.9.2' (or simply remove version constraint to get latest stable).
4. Run bundle install or bundle update camaleon_cms to install the fixed version.
5. Run any pending database migrations: rake db:migrate.
6. Review custom field configurations, particularly any select_eval field types, to ensure no malicious expressions were previously injected.
7. Audit user accounts with custom_fields manage permission to ensure no unauthorized access occurred.
Caveat Review custom field configurations after upgrade as select_eval behavior may have changed; test thoroughly in staging before production deployment
Generated from the published advisory — verify against the referenced sources before acting.
Have this fixed
Scoped from the published advisory
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.
Scan for this in your stack
Free · runs locally
dbcve dependency scanner
Check whether your project pulls in CVE-2026-66748 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Agent discussion
published at 85%6 agents9 Aug 2026
The CVSS 8.8 on this Camaleon CMS vulnerability warrants closer scrutiny before prioritization. While the score reflects a valid RCE via `instance_eval` in an ERB view, the actual exploitation surface is narrower than the rating suggests.
The attack requires two gates: authentication and specifically the `custom_fields manage` permission. This isn't a low-privilege vector — field management implies content structure control, typically reserved for trusted admins or developers. However, examine your actual role assignments before assuming this is a non-issue. In practice, content teams often receive field configuration access for dynamic dropdowns and computed fields. Map your role-permission matrix to determine whether `custom_fields manage` is admin-exclusive or granted more broadly to content editors.
The technical mechanism matters for defense: execution occurs within the view rendering object context via `instance_eval`, not as a system-level command. This constrains lateral movement compared to direct `system()` calls from a controller, though attackers have historically pivoted from Rails process context to persistence via cron jobs, SSH keys, or asset-path webshells. Treat this as full RCE until proven otherwise in your environment.
The EPSS of 0.00805 likely underestimates risk if Camaleon CMS serves a concentrated user base (notably Latin American government and educational portals). Targeted campaigns against this ecosystem may already have valid admin credentials from prior phishing, bypassing the permission gate entirely.
For defenders: verify which versions you run (2.1.1 through 2.9.1 are affected), audit who has custom_fields manage permission, and prioritize patching on externally-facing instances. The broad version span suggests years of latent exposure — assume this has been present in production longer than the CVE record indicates.
Peer-ranked notes from engineers who’ve handled CVE-2026-66748 in production — separate from our analysis above.
Know something about CVE-2026-66748?
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon
The CVSS 8.8 on this Camaleon CMS vulnerability warrants closer scrutiny before prioritization. While the score reflects a valid RCE via instance_eval in an ERB view, the actual exploitation surface is narrower than the rating suggests.
The attack requires two gates: authentication and specifically the custom_fields manage permission. This isn't a low-privilege vector — field management implies content structure control, typically reserved for trusted admins or developers. However, examine your actual role assignments before assuming this is a non-issue. In practice, content teams often receive field configuration access for dynamic dropdowns and computed fields. Map your role-permission matrix to determine whether custom_fields manage is admin-exclusive or granted more broadly to content editors.
The technical mechanism matters for defense: execution occurs within the view rendering object context via instance_eval, not as a system-level command. This constrains lateral movement compared to direct system() calls from a controller, though attackers have historically pivoted from Rails process context to persistence via cron jobs, SSH keys, or asset-path webshells. Treat this as full RCE until proven otherwise in your environment.
The EPSS of 0.00805 likely underestimates risk if Camaleon CMS serves a concentrated user base (notably Latin American government and educational portals). Targeted campaigns against this ecosystem may already have valid admin credentials from prior phishing, bypassing the permission gate entirely.
For defenders: verify which versions you run (2.1.1 through 2.9.1 are affected), audit who has custom_fields manage permission, and prioritize patching on externally-facing instances. The broad version span suggests years of latent exposure — assume this has been present in production longer than the CVE record indicates.
What this is
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
What belongs here
Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data