The vulnerability resides in Thelia 2.6.1’s template handling. When a user supplies an absolute file path to Smarty, the checkTemplate() function permits it, enabling the template engine to load and compile arbitrary files from the server. Because the template is processed with the same privileges as the web server, an attacker who can supply such a path can inject and execute code, resulting in remote code execution on the host. This flaw is fundamentally a path traversal combined with server side template injection (SSTI), allowing full control over the server process.

The affected product is Thelia, a free–open source e‑commerce platform based on PHP and Smarty. The flaw is present in version 2.6.1 and any earlier release that does not include the patch for the absolute path validation. The issue is exploitable whenever the application allows authenticated users to edit or upload templates via the front‑end or admin interface, giving them the ability to specify an arbitrary absolute filesystem path.

No CVSS or EPSS score is publicly defined for this CVE, and it is not listed in the CISA KEV catalog, so the exact numeric risk cannot be quantified. Nevertheless the flaw permits arbitrary code execution with the web server’s privileges; if the server runs as a privileged user, escalation is possible. The attack vector requires an attacker to be an authorized user or to compromise the authentication system. Because the vulnerability exists in web‑accessible code paths and no specific mitigations are provided by the CNA, the practical exploitation likelihood is high once the attacker has legitimate access. Rapid patching or configuration hardening is recommended.