CVE-2026-107248
8.8HighPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-94, CWE-1336
Impact
Authenticated back-office users with the 'Messages' permission can execute arbitrary PHP code and compromise the host. Attackers only need network access and valid credentials granting access to the Email/Messages feature.
Root cause
The Email/Messages back-office feature compiles user-supplied Twig templates into raw code without enabling sandbox restrictions.
Affected systems
Thelia 3.0.0 using thelia/twig-engine-module versions prior to 1.0.9
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade thelia/twig-engine-module to version 1.0.9 or later. If patching immediately is not possible, revoke the 'Messages' back-office permission from untrusted user roles.
$ composer require thelia/twig-engine-module:^1.0.9 --update-with-dependenciesAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.