CVE-2026-73331 describes an authenticated SQL injection vulnerability in CamaleonCMS 2.9.1. Attackers with post creation or editing privileges can inject malicious SQL syntax into the slug parameter, which is inadequately parameterized in database queries. This flaw enables the use of boolean- or union-based blind SQL injection techniques to retrieve sensitive information from the SQLite database, such as admin credentials and application configuration data.

Successful exploitation can lead to unauthorized disclosure of sensitive data stored in the application's SQLite database, including administrative credentials and configuration values. This compromises the confidentiality of the system and may facilitate further attacks or unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict post creation and editing privileges to trusted users only and monitor for suspicious activity related to slug inputs.