EUVD-2026-89477
GHSA-8648-mq73-m727
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as admin to ThinkCMF backend
-
DeliveryOpen Email Template editor
-
ExploitSubmit crafted template with SSTI payload
-
ExecutionServer renders and evaluates expression
-
ImpactDisclose or manipulate application data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V1 - Encoding and Sanitization Template injection prevention
|
| Exploitation Conditions | Requires an authenticated high-privilege (administrator) session with access to the Email Template management feature (MailController::templatePut in cmf-api/src/admin/controller/MailController.php) on ThinkCMF up to 8.0.7; the attacker must be able to submit a template body that reaches the template engine unsanitized. Limiting factors: PR:H means default anonymous or low-privilege users cannot exploit it - only accounts already trusted with admin template editing. No user interaction (UI:N) beyond the attacker's own submission, and it is network-reachable, but the admin-authentication barrier is the dominant constraint. No patched version is available since the vendor did not respond. |
| Impact | This is a genuinely low-priority issue despite being a server-side template injection (SSTI, CWE-1336) flaw, which in many contexts is a critical RCE vector. The controlling factor is the CVSS 4.0 vector's PR:H: exploitation requires an already-authenticated high-privilege (administrator) account, because the vulnerable MailController::templatePut function sits behind the ThinkCMF admin email-template management interface. The vendor-assigned CVSS 4.0 base score is only 2.0, with all three vulnerable-system impacts rated Low (VC:L/VI:L/VA:L) - reflecting that an admin injecting template code gains little beyond the privileges they already hold. Signals partly conflict: a public exploit exists (E:P, POC on GitHub) and the attack is network-reachable (AV:N/AC:L/AT:N), which raises the theoretical exposure, but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation. The 'Information Disclosure' tag understates the class - SSTI is a code-injection primitive - yet the low impact ratings are defensible given the PR:H precondition. Net: real but marginal risk, primarily an insider/privilege-abuse or post-compromise concern rather than a mass-exploitable perimeter flaw. |
| Exploit ScenarioDerived | An authenticated administrator (or an attacker who has already stolen admin credentials) navigates to the email template management feature and submits a crafted template payload containing template-engine expressions via the templatePut function. When the template is rendered, the injected expressions are evaluated server-side, allowing manipulation of application data or output. A public exploit report/POC is available on GitHub (coolcj-stack/ThinkCMF-v8.0.1-SSTI-Vulnerability), lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Server-side template injection in the Email Template component of ThinkCMF up to 8.0.7 lets an authenticated administrator submit template content that the underlying template engine evaluates server-side, enabling data exposure or logic execution within the application's privileges. Exploitation requires a privileged session able to reach MailController::templatePut in cmf-api/src/admin/controller/MailController.php, so anonymous and low-privilege users cannot trigger it; publicly available exploit code exists (a GitHub write-up targeting ThinkCMF v8.0.1), but there is no indication of confirmed active exploitation in CISA KEV. No vendor patch has been issued because the vendor did not respond to the disclosure, and independent assessment rates this a genuinely low-priority finding despite the SSTI classification.
RemediationAI
No vendor-released patch has been identified at the time of analysis: the vendor was contacted before publication and did not respond, and no fixed ThinkCMF version is documented in the available references (https://vuldb.com/vuln/411468, https://vuldb.com/cve/CVE-2026-102771). Because the exposure is gated behind an authenticated administrator session, the primary mitigation is to remove the attack surface and shrink the trusted admin population rather than rely on a fix that does not yet exist: disable or remove the Email Template admin feature (or block the route handling MailController::templatePut) until a patched release ships, accepting that administrators will lose the ability to edit mail templates through the UI and must manage templates on disk instead; restrict /cmf-api/admin and the rest of the ThinkCMF admin panel to an IP allowlist, management VPN, or zero-trust proxy, with the trade-off that legitimate administrators lose off-network access; enforce MFA and audit/rotate administrator credentials, since PR:H means any stolen admin session already satisfies the exploitation prerequisite; and apply least privilege so that template-editing capability is granted to as few accounts as possible. If the feature cannot be disabled, sanitize submitted template bodies against an explicit placeholder allowlist (rejecting template delimiters and expression/function-evaluation syntax before rendering) and deploy a WAF rule that blocks those delimiters on the admin mail-template endpoint, while monitoring for false positives and for legitimate templates that depend on dynamic expressions. Lastly, enable detailed admin action logging on mail-template saves and outbound connection monitoring for the web server process, since post-exploitation activity from an already-privileged account is the most likely detection signal; if the vendor remains unresponsive, plan migration to a maintained fork or an actively supported CMS with a documented security response process.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ThinkCMF is a PHP-based content management framework built on the ThinkPHP stack, and its admin email-template feature renders operator-supplied template bodies through the framework's template engine. CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) describes the root cause: the template body accepted by MailController::templatePut is passed to the engine without neutralizing template control syntax, so directives such as variable interpolation or expression-evaluation constructs are interpreted rather than treated as literal text. Template engines of this family can reach arbitrary PHP callables in many configurations, which is why SSTI is often equated with code execution, but in this specific case the independent assessment constrains the realistic effect to low confidentiality, integrity, and availability impact within the same security authority (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). The CPE metadata (cpe:2.3:a:naichen:thinkcmf:*:*:*:*:*:*:*:*) carries no version bound, so the affected footprint should be read as the ThinkCMF 8.x line through 8.0.7 plus any unpatched earlier release that still exposes the same controller path; the accompanying tags (PHP, SSTI, Information Disclosure, ThinkCMF) and the public PoC target (v8.0.1) reinforce that this is a persistent, version-agnostic weakness in the mail-template admin surface rather than a narrowly bounded regression.
Know when Thinkcmf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable admin feature requires high-privilege authentication (PR:H); SSTI by an already-privileged admin yields only limited additional confidentiality, integrity, and availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php. Rated critical severity (CVSS 9.8), this vulnerab
ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrato
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html ali
ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal a
ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable wit
ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the man
ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the ma
ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is expl
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileControl
app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerab
Privilege escalation in ThinkCMF through 8.0.1 allows an authenticated restricted backend administrator with a valid adm
Exploit-DB