Thelia CVE-2026-107248

Exploitation requires an authenticated back-office account that holds the specific 'Messages' permission; the attacker must use the Email/Messages template-editing feature to supply Twig template content. The decisive enabling condition is that the Twig templating engine is used UNSANDBOXED, so operator-supplied template markup is compiled and executed as raw PHP rather than rendered as inert text. Limiting factors that reduce realistic risk below the raw CVSS score: valid credentials plus the 'Messages' privilege are mandatory (PR:L, not unauthenticated), there is no mass-exploitation vector against anonymous users, and the affected component is the specific Thelia Twig engine module in Thelia 3.0.0; environments on the patched thelia/twig-engine-module 1.0.9 or without operator access to message templates are not exploitable.

Signals are mostly aligned toward a genuine but access-gated threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding full C:H/I:H/A:H impact via arbitrary PHP execution (CWE-94 SSTI) - a legitimately high base score of 8.8. However, EPSS is very low at 0.19% (8th percentile), the CVE is NOT on CISA KEV, and no public exploit (POC) is referenced, so there is no evidence of active or widespread exploitation. The key limiting factor NOT captured by the raw score is the PR:L requirement combined with the specific 'Messages' back-office permission: the attacker must already be an authenticated back-office operator with that permission, which sharply narrows the realistic attacker population to insiders or those who have already compromised privileged credentials. Net assessment: a real priority to patch for anyone running Thelia 3.0.0, because successful exploitation yields full host compromise, but it is NOT a drop-everything internet-wide emergency - the low EPSS and privileged-access precondition make this closer to a high-impact post-authentication/insider risk than a mass-exploitation external threat. No signals are directly conflicting; the CVSS network vector is consistent with the back-office being an authenticated web UI.

An authenticated back-office user (or an attacker who has phished or otherwise obtained such credentials) who holds the 'Messages' permission edits an Email/Message template and injects a malicious Twig payload. Because the templates are unsandboxed and compiled to raw PHP, the payload executes arbitrary PHP functions on the server - reading sensitive files, and potentially writing to the filesystem - leading to full application and host compromise. No public proof-of-concept exploit is referenced at time of analysis, so exploitation would currently require custom Twig/SSTI payload crafting.