CVE-2026-66748

EIP tracks 1 public exploit for CVE-2026-66748. PoCs published by theopaid.

AI-analyzed exploit summary This exploit demonstrates authenticated remote code execution (RCE) in Camaleon CMS via the `select_eval` custom field type, which executes arbitrary Ruby code via `instance_eval` when rendering post edit pages. The PoC includes a reverse shell payload and requires only `custom_fields` manage permissions.

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_eval within an ERB view whenever a post edit page is rendered, achieving server-side code execution with web server process privileges.