CVE-2026-103537
Received Received - Intake

Absolute Path Traversal in Thelia Leading to RCE

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: CERT/CC

Description
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-103537
EUVD
EUVD-2026-97483

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thelia Thelia 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Thelia 2.6.1 has an absolute path traversal flaw in its Smarty template handling that allows Server-Side Template Injection (SSTI) and remote code execution. The checkTemplate() function blocks relative paths like ../ but fails to stop absolute paths, letting an authorized user specify any filesystem path as a template. Smarty then loads and compiles the file without proper security checks, potentially executing malicious template code with the web server's privileges.

Detection Guidance

Check Thelia installations for version 2.6.1 or vulnerable configurations. Inspect template handling for absolute path usage in Smarty. Review file permissions and web server access logs for unusual template file loads.

Impact Analysis

An attacker with authorized access could exploit this to execute arbitrary code on the server, leading to full system compromise. This could allow data theft, unauthorized modifications, or complete takeover of the affected application and server.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade Thelia to a version that patches the absolute path traversal vulnerability in Smarty template handling. If an upgrade is not immediately possible, restrict filesystem access to prevent unauthorized template file execution and review Smarty configuration to enforce stricter security policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103537. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart