Updated advisory posts against rubysec/ruby-advisory-db@3642742

Author: jasnow

advisories/_posts/2026-07-28-GHSA-wppq-8h64-w78r.md

@@ -0,0 +1,49 @@
+---
+layout: advisory
+title: 'GHSA-wppq-8h64-w78r (alchemy_cms): Unauthenticated navigation-tree disclosure
+  via GET /api/nodes (missing authorization)'
+comments: false
+categories:
+- alchemy_cms
+advisory:
+  gem: alchemy_cms
+  ghsa: wppq-8h64-w78r
+  url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r
+  title: Unauthenticated navigation-tree disclosure via GET /api/nodes (missing authorization)
+  date: 2026-07-28
+  description: |-
+    ## Summary
+
+    Alchemy::Api::NodesController#index (GET /api/nodes) returns every
+    menu node of every site and every language with no authorization
+    check and no site/language scoping. It is the only API index action
+    with neither accessible_by nor authorize!. Because a menu node attached
+    to a page derives its name and url from that page (Node#name → page.name,
+    Node#url → page.url_path), an anonymous request also discloses names
+    and URL paths of pages that are restricted (members-only) or not
+    published (draft), plus any internal URLs editors placed in menus.
+
+    This is the same class the maintainer fixed in the sibling action
+    Api::PagesController#nested (advisory GHSA-mqq5-j7w8-2hgh) and in
+    PR #2145 ("Do not leak all records for guest users in API controllers").
+    nodes#index was not covered.
+  cvss_v3: 5.3
+  patched_versions:
+  - "~> 7.4.16"
+  - ">= 8.3.6"
+  related:
+    ghsa:
+    - mqq5-j7w8-2hgh
+    url:
+    - https://rubygems.org/gems/alchemy_cms/versions/8.3.6
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6
+    - https://github.com/AlchemyCMS/alchemy_cms/compare/v8.3.5...v8.3.6
+    - https://rubygems.org/gems/alchemy_cms/versions/7.4.16
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16
+    - https://github.com/AlchemyCMS/alchemy_cms/compare/v7.4.15...v7.4.16
+    - https://github.com/AlchemyCMS/alchemy_cms/pull/2145
+    - https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r
+  notes: |
+    - No CVE value in project GHSA
+    - cvss_v3 from project GHSA
+---

advisories/_posts/2026-07-31-CVE-2026-66748.md

@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2026-66748 (camaleon_cms): Camaleon CMS (2.1.1 to 2.9.1) contains an authenticated
+  RCE vulnerability'
+comments: false
+categories:
+- camaleon_cms
+advisory:
+  gem: camaleon_cms
+  cve: 2026-66748
+  ghsa: 7xm9-634w-f5r7
+  url: https://nvd.nist.gov/vuln/detail/CVE-2026-66748
+  title: Camaleon CMS (2.1.1 to 2.9.1) contains an authenticated RCE vulnerability
+  date: 2026-07-31
+  description: |-
+    Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated
+    remote code execution (RCE) vulnerability that allows users with
+    custom_fields manage permission to execute arbitrary Ruby code by
+    supplying a malicious expression through the select_eval custom field
+    type. Attackers can store an attacker-controlled Ruby expression in the
+    field options command parameter, which is evaluated via instance_eval
+    within an ERB view whenever a post edit page is rendered, achieving
+    server-side code execution with web server process privileges.
+  cvss_v3: 8.8
+  cvss_v4: 8.7
+  unaffected_versions:
+  - "< 2.1.1"
+  patched_versions:
+  - ">= 2.9.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-66748
+    - https://rubygems.org/gems/camaleon_cms/versions/2.9.2
+    - https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2
+    - https://github.com/owen2345/camaleon-cms/commit/158823668e2e5c3114a69b34cf1c96cb41533c5f
+    - https://github.com/owen2345/camaleon-cms/pull/1136
+    - https://github.com/theopaid/Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field
+    - https://www.vulncheck.com/advisories/camaleon-cms-authenticated-rce-via-select-eval-custom-field
+    - https://tpaidakis.com/writeups/camaleon-cms-rce-select-eval
+    - https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties
+    - https://github.com/advisories/GHSA-7xm9-634w-f5r7
+  notes: |
+    - NOTE: Global GHSA is unreviewed.
+    - cvss_v4 from nvd.nist.gov and GHSA URLs.
+    - cvss_v3 from nvd.nist.gov URL.
+    - date from nvd.nist.gov URL.
+---