CVE-2026-107248

Summary

Thelia 3.0.0 contains a server-side template injection vulnerability in its back-office email/messages feature that allows authenticated users with 'Messages' permission to inject and execute arbitrary PHP code through unsandboxed Twig templates, potentially leading to full application and host compromise.

Exploitability

Exploitation is relatively straightforward for authenticated users with Messages permission, requiring only the ability to modify message content to inject malicious Twig templates that execute as raw PHP code.

Blast radius

If exploited, this vulnerability could lead to complete compromise of the Thelia application and underlying host, allowing attackers to execute arbitrary commands, read sensitive files, and potentially write to the filesystem.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to thelia/twig-engine-module version 1.0.9 which contains the patch for this SSTI vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.