CVE-2026-102771: Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that the attacker needs high privileges. Exploitation is remote, requires no user interaction, and has low attack complexity.
Which deployments should be considered affected?
Naichen ThinkCMF versions up to and including 8.0.7 are identified as affected, specifically the Email Template component's MailController::templatePut function in cmf-api/src/admin/controller/MailController.php.
What is the likely impact if exploitation succeeds?
The reported impacts are low confidentiality, integrity, and availability impact. The issue involves improper neutralization of special elements in the template engine.
Is there public exploit information?
Yes. The exploit has been publicly disclosed and may be used.