CVE-2026-103528
5.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-1336
Impact
Authenticated administrators can execute arbitrary OS commands and read or write server files as the web server user. Exploitation requires network access and administrative credentials to edit email templates.
Root cause
Thelia fails to restrict dangerous PHP functions within Smarty template rendering, allowing template injection via the message configuration interface.
Affected systems
Thelia 2.6.0 (other versions not listed — check the vendor advisory)
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
No patched version is specified in the advisory; restrict access to the Thelia administrative messages interface or audit and restrict Smarty engine security policies to disable PHP functions.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.