CVE-2023-30145

Server-Side Template Injection in Camaleon CMS

9.8 CriticalPublic exploitFix available

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

45.9%Up 45.8 points since May 27, 2023

What each source reports

NVD Score used 9.8

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

Record: CVE-2023-30145
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

CVE List 9.8

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

Record: CVE-2023-30145
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2023-1646 9.8

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

Record: EUVD-2023-1646
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x487-866m-p8hr 9.8

Server-Side Template Injection in Camaleon CMS

Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

Record: GHSA-x487-866m-p8hr
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSV 9.8

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

Record: CVE-2023-30145
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-x487-866m-p8hr 9.8

Server-Side Template Injection in Camaleon CMS

Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

Record: GHSA-x487-866m-p8hr
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

Affected products

tuzitio camaleon cms

Affected packages

Affected packages
Package	Affected	Fixed
`camaleon_cms` RubyGems	before 2.7.4	2.7.4
`camaleon_cms` RubyGems	before 2.7.4, plus listed versions 0.0.10.0.20.1.20.1.30.1.4 Show 45 moreShow less 0.1.50.1.60.1.70.1.80.1.90.2.00.2.11.01.0.11.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.02.0.12.0.22.0.32.0.42.0.4.12.1.02.1.12.1.1.42.1.2.02.1.2.12.2.02.2.12.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.7.12.3.7.22.4.02.4.12.4.22.4.32.4.3.1	2.7.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)	2023-05-26
PoC in GitHub	paragbagul111/CVE-2023-30145	2023-05-25

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30145 is a critical vulnerability (CVSS 9.8) in Tuzitio Camaleon Cms, published May 26, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 45.9%, the 98th percentile. Fixed in camaleon_cms 2.7.4.

References

Show 7 moreShow less

This page doesn't list everything

Left out here: 59 versions. The JSON record has them.