Updated advisory posts against rubysec/ruby-advisory-db@f14cef9

Author: simi

advisories/_posts/2026-08-12-CVE-2026-73330.md

@@ -0,0 +1,41 @@
+---
+layout: advisory
+title: 'CVE-2026-73330 (camaleon_cms): CamaleonCMS 2.9.1 Server-Side Template Injection
+  via test_email Action'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2026-73330
+  ghsa: xgmr-hcvf-x3qc
+  url: https://nvd.nist.gov/vuln/detail/CVE-2026-73330
+  title: CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action
+  date: 2026-08-12
+  description: |-
+    CamaleonCMS 2.9.1 contains a server-side template injection vulnerability
+    that allows authenticated administrators to execute arbitrary commands
+    by embedding ERB tags in the email parameter of the test_email settings
+    action, which are evaluated when an SMTP rejection reflects the recipient
+    address back in the exception message rendered as an inline ERB template.
+    Attackers can submit a crafted email parameter containing ERB expressions
+    through the admin settings test_email endpoint, causing the Rails inline
+    template renderer to evaluate attacker-controlled Ruby code and achieve
+    arbitrary command execution as the Rails process user.
+  cvss_v3: 6.6
+  cvss_v4: 7.5
+  patched_versions:
+  - ">= 2.9.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-73330
+    - https://rubygems.org/gems/camaleon_cms/versions/2.9.2
+    - https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2
+    - https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/#44-stored-xss-via-draft-post-title
+    - https://www.vulncheck.com/advisories/camaleoncms-server-side-template-injection-via-test-email-action
+    - https://github.com/advisories/GHSA-xgmr-hcvf-x3qc
+  notes: |
+    - GHSA is unreviewed.
+    - cvss_v3 and cvss_v4 from nvd.nist.gov URL.
+    - gem name is "camaleon_cms" and repo name is "camaleon-cms".
+---