CVE-2026-73329 describes a stored cross-site scripting vulnerability in CamaleonCMS where unsanitized HTML payloads submitted as draft post titles by authenticated low-privileged users are persisted without escaping. When administrators view the drafts listing, the malicious payload executes in their browsers, enabling potential session hijacking and unauthorized actions. The vulnerability arises from improper neutralization of input during web page generation, specifically in the post title parameter during draft creation.

Successful exploitation allows attackers with low privileges to execute arbitrary JavaScript in the context of an administrator's browser. This can lead to administrator session compromise, theft of authentication cookies, and the ability to forge authenticated requests, potentially resulting in full administrative control over the CMS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict draft creation privileges to trusted users only and consider monitoring or filtering input to the post title parameter to prevent injection of malicious HTML.