Thelia CVE-2026-103528

Exploitation requires an authenticated session with back-office administrator access to Thelia's email 'messages' configuration interface, where Smarty template content for emails can be edited. The payload executes only when the modified template is previewed or rendered (sending/preview of the email), and success depends on the Smarty environment not restricting dangerous PHP functions (system(), exec(), file_put_contents(), file_get_contents()) - which is the default insecure condition described. The principal limiting factor is the administrator privilege requirement, meaning an attacker must already control a high-privilege account; there is no unauthenticated or low-privilege path described, and impact is bounded by the web process's OS privileges.

This is a moderate-priority issue whose real-world risk is tempered by a high access barrier but understated by the recorded CVSS metrics. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4) conflicts internally with the description in two ways: (1) PR:L contradicts the text 'authenticated administrator' injecting via the messages configuration interface, which is an administrative capability and warrants PR:H; (2) the C:L/I:L/A:N impact drastically understates a described outcome of arbitrary OS command execution, file read/write, and full RCE, which should be C:H/I:H/A:H. These discrepancies mean the 5.4 base score should not be taken at face value - the true technical impact is critical, but it is gated behind administrator authentication. EPSS is low at 0.40% (32th percentile), consistent with the absence of KEV listing and no identified public exploit, indicating no evidence of active or widespread exploitation. Net: a genuinely severe post-authentication RCE/SSTI primitive, but one that requires an attacker to already hold admin privileges, so it is primarily a privilege-escalation-to-host and insider/compromised-admin concern rather than a mass-exploitation threat. No SSVC decision data was provided in the input.

An attacker who has obtained Thelia back-office administrator credentials (via phishing, credential reuse, or a separate flaw) logs into the admin panel and edits an email message template, inserting a malicious Smarty expression that calls a dangerous PHP function such as system() or file_put_contents(). When the template is previewed or an email is rendered, the payload executes with the privileges of the web server process, giving the attacker OS command execution on the host. No public exploit code was identified at time of analysis.