Server-side Template Injection Vulnerability in Thelia by Thelia Team

CVE-2026-107248

What is CVE-2026-107248?

Thelia 3.0.0 contains a server-side template injection (SSTI) vulnerability in its back-office Email/Messages feature. This flaw enables any authenticated user with 'Messages' permissions to submit unsandboxed Twig templates that are subsequently compiled and executed as raw code. By manipulating message content, an attacker could execute arbitrary PHP functions, access sensitive files, and even modify the file system, posing a serious risk of complete compromise of the application and its host environment. The vulnerability has been addressed in the latest release of the thelia/twig-engine-module version 1.0.9.

References