CVE-2026-103528 Details

A vulnerability exists in Thelia versions 2.6.0 and 2.6.1, where the application uses the Smarty template engine for email templates without adequately restricting access to potentially harmful PHP functions. This flaw allows authenticated administrators to inject malicious Smarty expressions into email templates through the messages configuration interface. When the template is previewed or rendered, injected functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This exploitation could lead to arbitrary execution of operating system commands, unauthorized file read/write operations, and remote code execution on the server.