CVE-2026-102771 in ThinkCMF
Summary
by MITRE • 09/30/2026
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in Naichen ThinkCMF versions up to 8.0.7 represents a critical server-side template injection flaw located within the Email Template component, specifically affecting the MailController::templatePut function found in cmf-api/src/admin/controller/MailController.php. This issue stems from an improper neutralization of special elements used by the underlying template engine. In web application architecture, template engines are designed to separate presentation logic from business logic, but when user-supplied input is not adequately sanitized before being processed or rendered by these engines, it allows attackers to inject malicious code that executes within the context of the server-side script. This specific failure in input validation means that special characters and control sequences intended for structural purposes can be interpreted as executable commands rather than static data, fundamentally breaking the security boundary between user input and application logic.
From a technical perspective, this flaw is classified under CWE-94 Improper Control of Generation of Code (Code Injection), which encompasses server-side template injection vulnerabilities where an attacker gains the ability to execute arbitrary code on the target system. The operational impact of such a vulnerability is severe, as it typically allows for remote code execution without requiring authentication if the affected endpoint is accessible, or privilege escalation if administrative access is required but compromised through other means. Since the exploit has been disclosed publicly and is known to be functional, automated scanning tools and malicious actors can readily leverage this weakness to compromise the integrity of the application environment. The consequences may include full system takeover, data exfiltration, defacement, or using the compromised server as a pivot point for further attacks within the internal network infrastructure.
The attack vector for this vulnerability is remote, meaning it does not require physical access or local shell access to exploit. An attacker can potentially trigger the injection by sending specially crafted HTTP requests to the MailController::templatePut endpoint, manipulating parameters that are subsequently passed into the template engine without proper escaping or validation. The lack of response from the vendor since early contact suggests a significant gap in security maintenance and patch management for this software version. Organizations relying on ThinkCMF versions prior to 8.0.7 face heightened risk due to the availability of public exploits, which lowers the barrier to entry for attackers who may not possess advanced exploitation skills but can utilize existing proof-of-concept code found online.
To mitigate this vulnerability, immediate action is required to update Naichen ThinkCMF to a version later than 8.0.7 where the input validation in the MailController has been corrected. If upgrading is not immediately feasible due to compatibility constraints or operational downtime requirements, temporary mitigations should be implemented at the web application firewall level to block requests containing suspicious template injection patterns targeting the affected endpoint. Additionally, administrators should enforce strict principle of least privilege for any administrative interfaces and ensure that server-side rendering processes do not execute dynamic code from user inputs unless absolutely necessary and rigorously validated. Continuous monitoring of access logs for anomalous request patterns associated with template engines can also aid in early detection of exploitation attempts while the system remains vulnerable.