CVE-2026-103537
CVE-2026-103537
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.
| Vendor | thelia |
| Product | thelia |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for thelia thelia
Be the first to know when new unknown vulnerabilities affecting thelia thelia are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Thelia / Thelia
0 ≤ 2.6.1