Arbitrary Command Execution Vulnerability in Thelia by Thelia

CVE-2026-103528

What is CVE-2026-103528?

Thelia 2.6.0 employs Smarty for its email templates but lacks proper access restrictions on potentially dangerous PHP functions. This oversight permits an authenticated administrator to inject harmful Smarty expressions into email templates via the messages configuration interface. When these templates are previewed or rendered, they can execute critical functions like system(), exec(), file_put_contents(), and file_get_contents(), running under the web process's privileges. This vulnerability exposes the system to arbitrary command execution, unauthorized access to files, and remote code execution, posing a significant threat to the underlying server integrity.

References