CVE-2026-103537 Thelia CVE debrief

Who should care

Defenders of Thelia 2.6.1 deployments should assess exposure and prioritize remediation. Web application security teams and administrators responsible for Thelia instances should verify and restrict template loading mechanisms, implement effective security policies for Smarty template handling, and restrict file system access for web server processes.

Why it matters

CVE-2026-103537 is a high-severity vulnerability in Thelia 2.6.1 that allows remote code execution. Defenders should prioritize remediation and verify deployments to prevent potential exploitation.

• Remote code execution with web server privileges
• Potential for unauthorized access to sensitive data
• Possible disruption of web application services
• Need for verification of affected versions and deployments

Technical summary

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling, enabling SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges. This vulnerability can lead to remote code execution with web server privileges, potential unauthorized access to sensitive data, and possible disruption

Defensive priority

High

Recommended defensive actions

• Review and restrict template loading mechanisms in Thelia 2.6.1
• Implement effective security policies for Smarty template handling
• Verify and restrict file system access for web server processes
• Update Thelia to a version that addresses this vulnerability, if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on an absolute path traversal vulnerability in Thelia 2.6.1, enabling SSTI and remote code execution. The vulnerability is caused by the `checkTemplate()` validation not rejecting absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.