CVE-2023-30145: Camaleon CMS SSTI via formats parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction exploitation and public exploit code plus high EPSS make this an urgent patch target.

What it is

Camaleon CMS v2.7.0 contains a server-side template injection flaw reached through the formats parameter. Because template injection lets an attacker run code in the server-side template engine, it can lead to full compromise of the application host. The record names only version 2.7.0 and gives no further detail on the vulnerable code path.

Impact

An attacker can execute arbitrary code in the context of the Camaleon CMS server, gaining control over application data and the underlying host. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is network-reachable with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. It is triggered by supplying crafted input to the formats parameter.

Exploitation

Public exploit references exist, including Packet Storm and a GitHub proof-of-concept, and EPSS is 0.46136 (98.8th percentile), indicating elevated likelihood of exploitation. The CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Upgrade Camaleon CMS to a version later than 2.7.0 once the vendor publishes a fix; the record does not name a fixed version.
• If upgrade is not possible, restrict or disable untrusted input to the formats parameter and validate it against a strict allowlist.
• Place the CMS behind authentication or network restrictions so the endpoint is not anonymously reachable.
• Run the application with least privilege and isolate it so template code execution cannot reach sensitive host resources.

Detection

• Monitor requests where the formats parameter contains template syntax such as {{ }}, ${ } or <% %>.
• Alert on unexpected child processes or outbound connections spawned by the Camaleon CMS web process.
• Review web logs for anomalous requests to endpoints handling the formats parameter, especially from unauthenticated clients.
• Watch for known exploit payload strings from the public Packet Storm and GitHub proof-of-concept references.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.