CVE-2026-103528 in Thelia
Summary
by MITRE • 10/12/2026
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Thelia version 2.6.0 represents a critical security flaw rooted in improper input validation and insufficient restriction of dangerous PHP functions within its template engine integration. Specifically, the application utilizes Smarty for rendering email templates but fails to adequately sanitize or restrict access to sensitive system-level operations when processing user-supplied data. This architectural oversight creates an avenue for attackers who have obtained authenticated administrator credentials to exploit the message configuration interface. By injecting malicious Smarty expressions into these configurations, an attacker can manipulate how the template engine processes and executes code during the rendering phase. The core technical flaw lies in the lack of strict whitelisting or sandboxing mechanisms that would prevent the execution of high-risk PHP functions such as system(), exec(), file_put_contents(), and file_get_contents(). These functions are typically restricted to prevent arbitrary command execution, but their availability within this specific context allows for severe compromise.
From an operational perspective, this vulnerability enables Remote Code Execution (RCE) with the privileges of the web server process. When a malicious template is previewed or rendered by an administrator or any other user with access to view these messages, the injected code executes on the backend server. This capability extends beyond simple command execution; it allows for arbitrary file read and write operations. An attacker can use functions like file_get_contents() to exfiltrate sensitive configuration files, database credentials, or source code from the application directory. Conversely, using file_put_contents(), an attacker can upload web shells or modify existing scripts to maintain persistent access. The ability to execute system commands means that once initial foothold is gained through this vector, lateral movement within the network becomes feasible, potentially leading to full compromise of the underlying operating system and any connected services.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves injecting executable code into a context where it will be interpreted by an application engine. Furthermore, in terms of tactical classification under MITRE ATT&CK, this behavior maps to T1059 Command and Scripting Interpreter for the execution of system commands via functions like exec() or system(), and potentially T1204 User Execution if social engineering is used to trick administrators into previewing malicious templates. The attack vector requires authentication, which classifies it as an authenticated insider threat scenario or a result of compromised administrative credentials rather than unauthenticated remote exploitation.
Mitigation strategies must focus on immediate remediation of the codebase and enhanced security controls. The primary fix involves upgrading Thelia to a patched version where these dangerous functions are properly restricted within Smarty templates, ensuring that only safe, predefined variables and methods can be used in email rendering contexts. If an upgrade is not immediately feasible, administrators should implement strict input validation on all fields related to message configuration to prevent the injection of Smarty syntax containing function calls. Additionally, deploying a Web Application Firewall (WAF) with rules specifically targeting common code injection patterns in template engines can provide a layer of defense-in-depth. It is also critical to enforce strong access controls and multi-factor authentication for administrative accounts to reduce the risk of credential compromise that leads to this exploitation vector. Regular auditing of application logs for unusual activity related to email rendering or file system changes should be conducted to detect potential attempts at exploiting this flaw.