CVE-2026-103537
5.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-94, CWE-1336
Impact
Authenticated attackers can achieve remote code execution under the web server's privileges via server-side template injection. They need low-privileged authorized access and an uploaded or existing file on the filesystem containing template payloads.
Root cause
The checkTemplate() function checks for relative directory traversal sequences like ../ but fails to block absolute file paths, allowing Smarty to load and compile arbitrary local files.
Affected systems
Thelia 2.6.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade to a version newer than 2.6.1 if available from the vendor, or patch checkTemplate() to reject leading slashes and absolute paths when validating template file inputs.
$ composer show thelia/theliaAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.