An authenticated user with the custom_fields manage permission can insert a malicious Ruby expression into the select_eval custom field type. When a post edit page is rendered, the expression is evaluated using instance_eval within an ERB view, allowing arbitrary code execution with the web server process privileges. This behavior is a classic instance of code injection (CWE‑94) and can compromise the entire website and its underlying system.

Camaleon CMS versions 2.1.1 through 2.9.1 of the owen2345:camaleon-cms product are affected. Users who can manage custom fields for the site are at risk, while other accounts are not directly impacted.

The vulnerability scores a CVSS of 8.7, indicating a high severity. The EPSS score is less than 1%, showing a very low probability of exploitation at this time, and the issue is not listed in CISA’s KEV catalog. Attackers need valid credentials with custom_fields manage rights, which typically implies internal access or a stolen account. Consequently, while the potential impact is severe, the likelihood of real‑world attacks remains low until a wider distribution or credential compromise occurs. Prompt patching is still recommended to eliminate this high‑impact code execution vector.