Thelia: Server-side template injection in back-office messages
Summary
Thelia 3.0.0 does not sandbox Twig templates in the back-office Messages/Email feature. An authenticated user with the "Messages" permission can change message content so that it is compiled and executed as code. This can allow execution of arbitrary PHP functions, reading of sensitive files and possibly writing to the filesystem, which may lead to full compromise of the application and the host.
Affected
- Thelia 3.0.0 (per CVE record and CNA data)
- Exploitation requires a logged-in back-office user with the "Messages" permission
- Core version scope beyond 3.0.0 is unknown.
Fixed in
- Patched in thelia/twig-engine-module 1.0.9 (per CVE record)
- Unknown: whether 1.0.9 fixes Thelia core 3.0.0 itself, or whether a separate core patch exists. No vendor advisory was found.
Workaround
- Unknown: no vendor-listed workaround beyond the module update.
- Restrict access to the back office (for example VPN or IP allowlist) to reduce exposure.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS score 0.19%. Not listed in KEV. No evidence of exploitation in the wild found.
- No public proof of concept found; VulDB states no available exploit but rates exploitation as easy.
Our recommendation
- Update thelia/twig-engine-module to 1.0.9 or later and verify the Thelia core version with the vendor.
- Review which accounts hold the "Messages" permission and remove it where not needed.
- Audit existing message and email templates for unexpected Twig syntax.
- Check for unexpected files on web-accessible paths and review admin logs for recent message edits.
- If a 2.6.x installation is in use, assess the related CERT/CC advisory separately.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT/CC Vulnerability Note VU#162329 kb.cert.org
- OpenCVE: CVE-2026-107248 app.opencve.io
- Packagist: thelia/twig-engine-module root.packagist.org
- GitHub issue: CVE-2026-107248 score and EPSS github.com
- VulDB: CVE-2026-107248 vuldb.com
- Strix: CVE-2026-107248 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:27.
Original description (NVD)
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.