CVE-2026-107248: Code Injection

Q: Who can exploit this issue?

An authenticated Thelia user who has the “Messages” permission can exploit it. The vulnerable functionality is the back-office Email/Messages feature.

Q: What access or input does an attacker need?

The attacker needs to be able to modify Message content and submit Twig template syntax through that feature. The supplied template is compiled and executed without sandboxing.

Q: What is the potential impact of successful exploitation?

An attacker can execute arbitrary PHP functions and read sensitive files. They may also be able to write to the filesystem, potentially compromising the application and underlying host.

Q: Which component contains the fix?

The issue is patched in thelia/twig-engine-module version 1.0.9.

Published Oct 12, 2026

Updated

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.

Affected Software

2 affected components

Thelia Thelia=3.0.0

composer/thelia/twig-engine-module<1.0.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade thelia/twig-engine-module to a version that resolves this vulnerability.
Fixed in 1.0.9

Event History

Oct 12, 2026

CVE Published

via MITRE·03:06 PM

Data Sourced

via MITRE·03:06 PM

DescriptionWeakness

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Who can exploit this issue?

An authenticated Thelia user who has the “Messages” permission can exploit it. The vulnerable functionality is the back-office Email/Messages feature.

What access or input does an attacker need?

The attacker needs to be able to modify Message content and submit Twig template syntax through that feature. The supplied template is compiled and executed without sandboxing.

What is the potential impact of successful exploitation?

An attacker can execute arbitrary PHP functions and read sensitive files. They may also be able to write to the filesystem, potentially compromising the application and underlying host.

Which component contains the fix?

The issue is patched in thelia/twig-engine-module version 1.0.9.

CVE-2026-107248: Code Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access or input does an attacker need?

What is the potential impact of successful exploitation?

Which component contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or input does an attacker need?

What is the potential impact of successful exploitation?

Which component contains the fix?