Description
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.
Published: 2026-10-12
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

Thelia 3.0.0 back-office Email/Messages feature contains a server-side template injection flaw. An authenticated user with the Messages permission can supply unsandboxed Twig templates that are compiled and executed as raw PHP. This allows execution of arbitrary PHP functions and reading or writing sensitive files, leading to full compromise of the application and underlying host.

Affected Systems

The affected product is Thelia 3.0.0. The vulnerability exists in the Email/Messages module of the back-office. A fix is included in thelia/twig-engine-module 1.0.9.

Risk and Exploitability

The CVSS score is not provided and EPSS is unavailable, but the nature of the flaw indicates a high exploitation likelihood for an authenticated attacker. The vulnerability is classified as remote code execution within the application layer. It is not listed in CISA KEV. Exploitation requires the user to have Messages permission in the back-office; there is no known public exploit yet.

Generated by OpenCVE AI on October 12, 2026 at 16:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch by upgrading thelia/twig-engine-module to version 1.0.9 or later.
  • Update the core Thelia system to the latest version that includes the patched module.
  • Restrict the Messages permission to trusted users and consider disabling the back-office Email/Messages feature if not needed.

Generated by OpenCVE AI on October 12, 2026 at 16:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://kb.cert.org/vuls/id/162329 cve-icon cve-icon
History

Thu, 15 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1336
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Thelia
Thelia thelia
Vendors & Products Thelia
Thelia thelia

Mon, 12 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-94

Mon, 12 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.
Title CVE-2026-107248
References

Subscriptions

Thelia Thelia
cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2026-10-15T17:07:20.054Z

Reserved: 2026-10-07T15:19:06.002Z

Link: CVE-2026-107248

cve-icon Vulnrichment

Updated: 2026-10-15T17:07:16.499Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T16:17:03.203

Modified: 2026-10-15T18:17:24.270

Link: CVE-2026-107248

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:26:55Z

Weaknesses
  • CWE-1336

    Improper Neutralization of Special Elements Used in a Template Engine

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')