Absolute Path Traversal in Thelia 2.6.1 Template Handling

CVE-2026-103537

What is CVE-2026-103537?

Thelia version 2.6.1 is susceptible to an absolute path traversal vulnerability in its Smarty template handling. This flaw allows authorized users to manipulate the checkTemplate() functionality to provide arbitrary filesystem paths as templates. Unlike relative directory traversal sequences, absolute paths are not restricted, enabling Smarty to load and execute template files without sufficient security measures. As a result, depending on the server’s filesystem configuration, malicious code can be executed with the privileges of the web server, posing a significant risk.

References