Merge pull request #1214 from jasnow/aug-15a-advs

One new CVE (camaleon_cms) advisory

Author: simi

gems/camaleon_cms/CVE-2026-73330.yml

@@ -0,0 +1,33 @@
+---
+gem: camaleon_cms
+cve: 2026-73330
+ghsa: xgmr-hcvf-x3qc
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-73330
+title: CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action
+date: 2026-08-12
+description: |
+  CamaleonCMS 2.9.1 contains a server-side template injection vulnerability
+  that allows authenticated administrators to execute arbitrary commands
+  by embedding ERB tags in the email parameter of the test_email settings
+  action, which are evaluated when an SMTP rejection reflects the recipient
+  address back in the exception message rendered as an inline ERB template.
+  Attackers can submit a crafted email parameter containing ERB expressions
+  through the admin settings test_email endpoint, causing the Rails inline
+  template renderer to evaluate attacker-controlled Ruby code and achieve
+  arbitrary command execution as the Rails process user.
+cvss_v3: 6.6
+cvss_v4: 7.5
+patched_versions:
+  - ">= 2.9.2"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-73330
+    - https://rubygems.org/gems/camaleon_cms/versions/2.9.2
+    - https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2
+    - https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/#44-stored-xss-via-draft-post-title
+    - https://www.vulncheck.com/advisories/camaleoncms-server-side-template-injection-via-test-email-action
+    - https://github.com/advisories/GHSA-xgmr-hcvf-x3qc
+notes: |
+  - GHSA is unreviewed.
+  - cvss_v3 and cvss_v4 from nvd.nist.gov URL.
+  - gem name is "camaleon_cms" and repo name is "camaleon-cms".