Thelia CVE-2026-103537

Exploitation requires an authenticated 'authorized user' account with access to Smarty template-name handling in Thelia (PR:L), so it is a post-authentication primitive, not remote-unauthenticated. The specific flaw: the checkTemplate() validation rejects relative directory-traversal sequences ('../') but does NOT reject absolute filesystem paths, letting the attacker point Smarty at an arbitrary file. Two deployment-dependent limiting factors gate actual code execution: (1) Smarty must load and compile without an effective security policy enabled, and (2) the attacker must be able to reference a file whose contents contain executable template code - this depends on the filesystem layout and deployment configuration, meaning the full SSTI-to-RCE outcome is not guaranteed on every install. Affected: Thelia versions up to and including 2.6.1.

This is a moderate, conditional-RCE issue rather than a top-priority emergency, and the signals are largely consistent on that point. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) models a network-reachable flaw requiring an already-authenticated user (PR:L) with only Low confidentiality and integrity impact and no availability impact - which is notably conservative given the description claims SSTI leading to remote code execution. The gap is explained by the description's own hedging: code execution occurs only 'depending on filesystem layout and deployment configuration,' so the scorers appear to have discounted full RCE impact because it is not reliably achievable, leaving C:L/I:L. EPSS is low at 0.40% (32nd percentile), there is no CISA KEV listing, and no public exploit is identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' All exploitation signals (low EPSS, no KEV, no POC) align toward low near-term real-world exploitation. The key tension to verify: the description asserts RCE but the official vector caps impact at Low/Low - if a given deployment's filesystem layout allows loading an attacker-controlled template file, the true impact is far higher than 5.4 suggests, so defenders should treat the CVSS score as a floor, not a ceiling. Also note the vulnerability requires an 'authorized user,' consistent with PR:L - this is a privilege-escalation/post-authentication RCE primitive, not an unauthenticated internet-wide threat.

An authenticated back-office user of a Thelia store supplies an absolute filesystem path (e.g. a path to a file they can influence such as an upload, log, or shared location) as a Smarty template name; checkTemplate() blocks '../' sequences but not absolute paths, so Smarty loads and compiles the attacker-referenced file. If that file contains Smarty/PHP template code, it is executed with the web server's privileges, yielding server-side template injection and potential remote code execution. No public exploit code was identified at time of analysis, and success depends on the specific filesystem layout and deployment configuration.