Thelia 2.6.0 includes Smarty email template support that fails to restrict dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into message templates. When the template is previewed or rendered, PHP functions such as system(), exec(), file_put_contents(), and file_get_contents() are invoked with the web process privilege, allowing the attacker to execute arbitrary OS commands and read or write arbitrary files on the underlying server. This vulnerability enables full compromise of confidentiality, integrity, and availability on the affected system.

The affected product is Thelia 2.6.0. No other versions were explicitly listed in the advisory.

The EPSS score is not available and the vulnerability is not listed in KEV. The CVSS score is not provided, so an exact severity rating cannot be supplied. Based on the description, the likely attack vector requires an authenticated administrator; therefore the vulnerability would be exploitable after an adversary gains admin credentials or compromises an admin account.