--- title: CVE-2026-73330 (camaleon_cms): CamaleonCMS 2.9.1... description: CamaleonCMS 2.9.1 has a server-side template injection vulnerability (CVE-2026-73330, GHSA-xgmr-hcvf-x3qc) in the test_email settings action. Authenticated... canonical: https://daily.dev/posts/cve-2026-73330-camaleon-cms-camaleoncms-2-9-1-server-side-template-injection-via-test-email-actio-op3ubcy08 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-73330 (camaleon_cms): CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action | daily.dev og:description: CamaleonCMS 2.9.1 has a server-side template injection vulnerability (CVE-2026-73330, GHSA-xgmr-hcvf-x3qc) in the test_email settings action. Authenticated... og:url: https://daily.dev/posts/cve-2026-73330-camaleon-cms-camaleoncms-2-9-1-server-side-template-injection-via-test-email-actio-op3ubcy08 og:image: https://api.daily.dev/og/posts/Op3ubCy08.png og:image:alt: CVE-2026-73330 (camaleon_cms): CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-73330 (camaleon_cms): CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action **[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 1 upvotes · 0 comments ## Summary CamaleonCMS 2.9.1 has a server-side template injection vulnerability (CVE-2026-73330, GHSA-xgmr-hcvf-x3qc) in the test_email settings action. Authenticated admins can embed ERB tags in the email parameter, which get evaluated when an SMTP rejection reflects the address back into an inline ERB template, leading to arbitrary command execution as the Rails process user. CVSS v3.x score is 6.6 (Medium). The issue is patched in version 2.9.2. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-73330 in CamaleonCMS 2.9.1? It is a server-side template injection vulnerability in the test_email settings action of CamaleonCMS 2.9.1. An authenticated administrator can embed ERB tags in the email parameter; when the SMTP server rejects that address, the rejection message reflects the input and gets evaluated as an inline ERB template, letting an attacker execute arbitrary commands as the Rails process user. It carries a CVSS v3 score of 6.6 (Medium) and is fixed in version 2.9.2. _Teams patching Rails CMS vulnerabilities can track advisories like this one on daily.dev._ ### How do I fix the server-side template injection vulnerability in CamaleonCMS test_email? Upgrade CamaleonCMS to version 2.9.2 or later, which patches the vulnerability tracked as CVE-2026-73330 and GHSA-xgmr-hcvf-x3qc. The flaw allowed admins to inject ERB code through the test_email parameter that got evaluated when an SMTP rejection message was rendered as an inline template, resulting in arbitrary command execution. _daily.dev helps developers stay on top of CMS patch releases like this CamaleonCMS fix._ ## Similar posts on daily.dev - [CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution](https://daily.dev/posts/csa-issues-alert-on-critical-smartermail-bug-allowing-remote-code-execution-um9ujxuhl) · The Hacker News · 0 upvotes · 0 comments - [Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin](https://daily.dev/posts/hackers-exploit-info-disclosure-bug-in-gravity-smtp-wordpress-plugin-4vu35e6v7) · BleepingComputer · 1 upvotes · 0 comments - [Multiple XSS Vulnerabilities Found in Mailcow, Including Unauthenticated Account Takeover](https://daily.dev/posts/multiple-xss-vulnerabilities-found-in-mailcow-including-unauthenticated-account-takeover-lxncoxjj2) · Aikido Security · 0 upvotes · 0 comments - [CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names \(Symfony Blog\)](https://daily.dev/posts/cve-2026-45070-email-header-injection-via-non-token-characters-in-mime-parameter-names-symfony-blo-ftprhukuv) · Symfony · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby), [#rails](https://daily.dev/tags/rails) [View this post on daily.dev](https://daily.dev/posts/cve-2026-73330-camaleon-cms-camaleoncms-2-9-1-server-side-template-injection-via-test-email-actio-op3ubcy08) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-73330 (camaleon_cms): CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action","url":"https://daily.dev/posts/cve-2026-73330-camaleon-cms-camaleoncms-2-9-1-server-side-template-injection-via-test-email-actio-op3ubcy08","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-73330-camaleon-cms-camaleoncms-2-9-1-server-side-template-injection-via-test-email-actio-op3ubcy08"},"datePublished":"2026-08-15T23:24:01.937Z","dateModified":"2026-09-14T06:18:32.856Z","description":"CamaleonCMS 2.9.1 has a server-side template injection vulnerability (CVE-2026-73330, GHSA-xgmr-hcvf-x3qc) in the test_email settings action. Authenticated...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-73330-camaleon-cms-camaleoncms-2-9-1-server-side-template-injection-via-test-email-actio-op3ubcy08","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby,rails","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"CVE-2026-73330 (camaleon_cms): CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cve-2026-73330-camaleon-cms-camaleoncms-2-9-1-server-side-template-injection-via-test-email-actio-op3ubcy08#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-73330 in CamaleonCMS 2.9.1?","acceptedAnswer":{"@type":"Answer","text":"It is a server-side template injection vulnerability in the test_email settings action of CamaleonCMS 2.9.1. An authenticated administrator can embed ERB tags in the email parameter; when the SMTP server rejects that address, the rejection message reflects the input and gets evaluated as an inline ERB template, letting an attacker execute arbitrary commands as the Rails process user. It carries a CVSS v3 score of 6.6 (Medium) and is fixed in version 2.9.2. Teams patching Rails CMS vulnerabilities can track advisories like this one on daily.dev."}},{"@type":"Question","name":"How do I fix the server-side template injection vulnerability in CamaleonCMS test_email?","acceptedAnswer":{"@type":"Answer","text":"Upgrade CamaleonCMS to version 2.9.2 or later, which patches the vulnerability tracked as CVE-2026-73330 and GHSA-xgmr-hcvf-x3qc. The flaw allowed admins to inject ERB code through the test_email parameter that got evaluated when an SMTP rejection message was rendered as an inline template, resulting in arbitrary command execution. daily.dev helps developers stay on top of CMS patch releases like this CamaleonCMS fix."}}]} ```