CVE-2026-107248 in Thelia
Summary
by MITRE • 10/12/2026
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The Thelia e-commerce platform version 3.0.0 contains a critical server-side template injection (SSTI) vulnerability within its back-office Email/Messages feature, specifically located in the twig-engine-module component prior to version 1.0.9. This flaw arises from an insecure handling of user-supplied input where the application fails to properly sanitize or sandbox Twig templates provided by authenticated users who possess the Messages permission. Instead of treating these inputs strictly as static content for rendering, the system compiles and executes them directly as raw PHP code within a permissive execution context. This architectural oversight allows any attacker with valid credentials and access to the messaging interface to inject malicious template syntax that bypasses standard security controls, effectively granting them the ability to execute arbitrary server-side commands under the privileges of the web application process.
The technical mechanism behind this vulnerability involves the direct evaluation of user-controlled data as executable code rather than rendering it safely through a restricted sandbox environment. In typical secure implementations, template engines like Twig employ strict sandboxes that limit access to dangerous methods and properties, ensuring that only predefined variables can be accessed during rendering. However, in this flawed implementation, the application accepts unsandboxed templates from users with specific permissions, allowing them to leverage PHP magic functions or direct object instantiation within the template syntax. By crafting a message payload containing malicious Twig expressions, an attacker can invoke arbitrary PHP functions, access superglobals such as $_GET and $_POST, and interact directly with the underlying file system. This capability transforms what appears to be a simple messaging feature into a powerful remote code execution vector that does not require privilege escalation beyond initial authentication.
The operational impact of this vulnerability is severe, leading potentially to full compromise of both the Thelia application and the hosting server environment. An attacker can exploit this flaw to read sensitive configuration files containing database credentials, API keys, or other secrets stored on the filesystem. Furthermore, the ability to write to arbitrary locations enables attackers to plant web shells for persistent access, modify existing scripts to alter business logic, or disrupt service availability by corrupting critical application files. Since Thelia is often deployed in production environments handling sensitive customer data and financial transactions, such a compromise can result in significant data breaches, regulatory non-compliance, and substantial reputational damage. The vulnerability affects any instance running version 3.0.0 with the affected module installed and unpatched, particularly those where users are allowed to create or edit email messages through the administrative interface.
To mitigate this risk, administrators must immediately upgrade the thelia/twig-engine-module to version 1.0.9 or later, which addresses the insecure template handling by enforcing proper sandboxing mechanisms for user-supplied content. In addition to applying the patch, organizations should review their access control policies to ensure that only trusted administrative roles have permission to create messages containing dynamic templates. Implementing a web application firewall with rules capable of detecting common SSTI patterns in HTTP requests can provide an additional layer of defense against exploitation attempts while patches are being deployed. Regular security audits and code reviews focusing on template engine configurations are recommended to prevent similar vulnerabilities arising from improper sanitization or execution contexts in future updates.