CVE-2026-103528

Deferred Deferred - Pending Action

Authenticated Administrator RCE via Smarty Template Injection in Thelia 2.6.0

Publication date: 2026-10-12

Last updated on: 2026-10-15

Assigner: CERT/CC

Description

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-12

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103528

EUVD

EUVD-2026-97480

Affected Vendors & Products

Vendor	Product	Version / Range
Thelia	Thelia	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

Thelia 2.6.0 uses Smarty for email templates without restricting access to dangerous PHP functions. An authenticated admin can inject malicious Smarty expressions into email templates via the messages configuration interface. When rendered, functions like system(), exec(), file_put_contents(), and file_get_contents() can be executed with web process privileges, enabling arbitrary OS command execution, file read/write, and remote code execution on the server.

Detection Guidance

Check Thelia admin email template configurations for unauthorized Smarty expressions containing PHP functions like system(), exec(), file_put_contents(), or file_get_contents(). Review template preview logs for unexpected command execution or file operations.

Impact Analysis

This vulnerability allows an attacker with admin access to execute arbitrary commands on the server, read or write files, and potentially gain full control of the system. It compromises confidentiality, integrity, and availability of data and services.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized data access, potential data breaches, and lack of proper access controls. It undermines data protection and security measures required by these regulations.

Mitigation Strategies

Upgrade Thelia to a patched version if available. Restrict admin access to email template editing. Disable dangerous Smarty functions in email templates. Monitor for unauthorized file changes or command execution.

Hi! I’m here to help you understand CVE-2026-103528. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70