CVE-2026-107248 Thelia CVE debrief

Who should care

Defenders of Thelia installations, particularly those with publicly accessible back-office interfaces or users with 'Messages' permission, should assess exposure and prioritize remediation. This includes reviewing system logs for suspicious activity and ensuring that only authorized users have access to the Messages feature. Additionally, security teams should verify that patch deployment is completed and monitor for potential exploitation attempts.

Why it matters

CVE-2026-107248 is a server-side template injection flaw in Thelia 3.0.0 that allows authenticated users to execute arbitrary code, read sensitive files, and potentially write to the filesystem. Defenders should prioritize remediation and restrict access to the Messages feature.

• Potential execution of arbitrary PHP functions
• Possible reading of sensitive files
• Potential writing to the filesystem
• Full compromise of the application and underlying host

Technical summary

Thelia 3.0.0's back-office Email/Messages feature contains a server-side template injection flaw. Authenticated users with 'Messages' permission can supply unsandboxed Twig templates, which are compiled and executed as raw code. This allows for arbitrary PHP function execution, sensitive file reading, and potential filesystem writing, leading to full application and host compromise. The vulnerability has been patched in thelia/twig-engine-module 1.0.9, which should be applied to affected installations. Defenders should restrict access to the Messages feature and monitor for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Review and update Thelia installations to version 3.0.0 with thelia/twig-engine-module 1.0.9
• Restrict access to the Messages feature to authorized users only
• Monitor for suspicious activity in Thelia application logs
• Confirm whether affected Thelia 3.0.0 deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed Thelia assets that need extra review.

Evidence notes

The CVE record and NVD entry detail a server-side template injection flaw in Thelia 3.0.0's back-office Email/Messages feature, allowing authenticated users to supply unsandboxed Twig templates. This flaw has been patched in thelia/twig-engine-module 1.0.9. Defenders should verify patch deployment and restrict access to the Messages feature.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.