CVE-2026-107248

Deferred Deferred - Pending Action

Server-Side Template Injection in Thelia 3.0.0

Publication date: 2026-10-12

Last updated on: 2026-10-15

Assigner: CERT/CC

Description

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-12

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107248

EUVD

EUVD-2026-97485

Affected Vendors & Products

Vendor	Product	Version / Range
Thelia	Thelia	3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is a server-side template injection (SSTI) flaw in Thelia 3.0.0's back-office Email/Messages feature. It allows authenticated users with the Messages permission to inject unsandboxed Twig templates. These templates are compiled and executed as raw code, enabling arbitrary PHP function execution, file reads, and potential filesystem writes.

Detection Guidance

Check Thelia installations for the vulnerable Email/Messages feature. Look for unsandboxed Twig template usage in message content. Verify if thelia/twig-engine-module version is below 1.0.9. Inspect server logs for unusual PHP function execution or file access patterns.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the server, read sensitive files, or modify system files. This could lead to full application compromise, data theft, or system takeover. The impact depends on the server's configuration and permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules. A breach could result in legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Mitigation Strategies

Update thelia/twig-engine-module to version 1.0.9 or later immediately. Restrict the 'Messages' permission to trusted users only. Review and sanitize all message content for suspicious Twig template syntax. Monitor filesystem and application logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-107248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70