CVE-2026-102771

Deferred Deferred - Pending Action

Improper Template Neutralization in Naichen ThinkCMF

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: VulDB

Description

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102771

EUVD

EUVD-2026-89477

Affected Vendors & Products

Vendor	Product	Version / Range
naichen	thinkcmf	to 8.0.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CWE-791	The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects Naichen ThinkCMF up to version 8.0.7. It is located in the MailController::templatePut function of the Email Template component. The issue involves improper neutralization of special elements in a template engine, which could allow remote attackers to manipulate email templates maliciously.

Detection Guidance

This vulnerability involves improper neutralization of special elements in a template engine within Naichen ThinkCMF up to 8.0.7. Detection requires checking for vulnerable versions of ThinkCMF and inspecting the MailController.php file for the templatePut function. No specific commands are provided in the context.

Impact Analysis

The vulnerability may allow remote attackers to inject malicious code into email templates, potentially leading to unauthorized actions or data breaches. Since the exploit is publicly disclosed, attackers could use it to compromise affected systems.

Compliance Impact

The vulnerability involves improper neutralization of special elements in a template engine, which could allow remote attackers to inject malicious code. This may lead to unauthorized data access or modification, potentially violating GDPR (data protection) and HIPAA (health data privacy) compliance if sensitive data is exposed or altered.

Mitigation Strategies

Immediately upgrade Naichen ThinkCMF to a version beyond 8.0.7 to address the improper neutralization issue in the Email Template component. If upgrading is not possible, restrict access to the MailController::templatePut function or disable the Email Template feature entirely.

Hi! I’m here to help you understand CVE-2026-102771. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70