Description
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.
Published:
2026-10-12
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Thelia | Thelia | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
| Link | Providers |
|---|---|
| https://kb.cert.org/vuls/id/162329 |
|
History
Mon, 12 Oct 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server. | |
| Title | CVE-2026-103528 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: certcc
Published:
Updated: 2026-10-12T14:55:14.883Z
Reserved: 2026-09-30T19:06:40.650Z
Link: CVE-2026-103528
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-12T15:17:06.350
Modified: 2026-10-12T15:17:06.350
Link: CVE-2026-103528
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.