Camaleon CMS versions 2.1.1 through 2.9.1 are affected by an authenticated remote code execution vulnerability tracked as CVE-2026-66748. Users with the custom_fields manage permission can exploit the select_eval custom field type to inject and execute arbitrary Ruby code. The malicious expression is stored in the field options command parameter and evaluated via instance_eval within an ERB view when a post edit page is rendered. This results in server-side code execution running with web server process privileges. The vulnerability requires authentication but can be triggered by lower-privileged users with specific permissions. A fix has been released in version 2.9.2. Proof-of-concept code and a GitHub pull request addressing the issue are publicly available, raising the risk of exploitation.