CVE-2023-30145 (CRITICAL 9.8) · Watchpost

← All vulnerabilities

Server-Side Template Injection in Camaleon CMS

CRITICAL 9.8CVE-2023-30145 · GHSA-x487-866m-p8hr · Published 26/05/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
camaleon_cms RubyGems	`< 2.7.4`	`2.7.4`
camaleon cms tuzitio	`≤ 2.7.0`	No fix yet

Description

Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

NVD description

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

References

nvd.nist.gov/vuln/detail/CVE-2023-30145 · ADVISORY
owen2345/camaleon-cms · WEB
owen2345/camaleon-cms commit 4485788 · WEB
book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection · WEB
drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view · WEB
owen2345/camaleon-cms · PACKAGE
owen2345/camaleon-cms release 2.7.4 · WEB
paragbagul111/CVE-2023-30145 · WEB
rubysec/ruby-advisory-db · WEB
portswigger.net/research/server-side-template-injection · WEB
packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free