Authenticated SQL Injection Vulnerability in CamaleonCMS by Camaleon

CVE-2026-73331

What is CVE-2026-73331?

CamaleonCMS version 2.9.1 is impacted by an authenticated SQL injection vulnerability. This flaw enables authenticated attackers, who possess post creation or editing privileges, to submit specially crafted slug values containing SQL syntax. When these values are submitted, the database backend mistakenly processes them as part of an improperly parameterized query. Utilizing techniques such as boolean or union-style blind SQL injection, attackers are able to extract sensitive information, including administrative credentials and configuration data that is stored in the SQLite database. This vulnerability highlights the need for stringent input validation and parameterized queries to protect sensitive data.

References