CVE-2026-73330 describes a server-side template injection vulnerability in CamaleonCMS 2.9.1. Authenticated administrators can exploit this by submitting a crafted email parameter containing ERB expressions to the admin settings test_email endpoint. When an SMTP rejection occurs, the recipient address is reflected in the exception message, which is rendered as an inline ERB template. This causes the Rails inline template renderer to evaluate attacker-controlled Ruby code, resulting in arbitrary command execution with the privileges of the Rails process user.

Successful exploitation allows authenticated administrators to execute arbitrary commands on the server hosting CamaleonCMS. This can lead to full system compromise under the Rails process user context. The vulnerability requires administrator privileges and high attack complexity, but no user interaction is needed beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the test_email settings action. Avoid using the test_email functionality if possible.