CVE-2026-103528 Thelia CVE debrief

Who should care

Defenders responsible for Thelia deployments, particularly those using version 2.6.0, should assess exposure and prioritize remediation. System administrators and security teams should review and restrict access to Smarty functions in email templates to prevent potential exploitation.

Why it matters

CVE-2026-103528 allows an authenticated administrator to inject malicious Smarty expressions into email templates in Thelia 2.6.0, potentially leading to arbitrary OS command execution, file read/write operations, and RCE. Defenders should assess exposure, prioritize remediation, and verify Thelia version and Smarty function restrictions.

• Arbitrary OS command execution
• File read/write operations on the underlying server
• Potential for Remote Code Execution (RCE)
• Verification of Thelia version and Smarty function restrictions required

Technical summary

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface. When the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process, allowing arbitrary OS command execution, file read/write operations, and RCE on the underlying server.

Defensive priority

High

Recommended defensive actions

• Review and restrict access to Smarty functions in email templates
• Update Thelia to a version that properly restricts access to dangerous PHP functions
• Monitor for suspicious activity in email template previews and rendering
• Confirm whether affected Thelia 2.6.0 deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on Thelia 2.6.0's use of Smarty for email templates without proper restrictions on dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions, leading to arbitrary OS command execution, file read/write operations, and RCE.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.