Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. (CVE-2026-103528)

Thelia version 2.6.0 incorporates Smarty templating for email templates but fails to restrict access to dangerous PHP functions within these templates. This vulnerability allows an authenticated administrator to inject malicious Smarty expressions through the messages configuration interface. When the email template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web server process. This results in arbitrary operating system command execution, file read and write capabilities, and remote code execution on the underlying server.

An attacker with authenticated administrator access can execute arbitrary OS commands and perform file operations on the server hosting Thelia 2.6.0. This can lead to full compromise of the server environment, data theft, data manipulation, or further lateral movement within the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and avoid previewing or rendering email templates with untrusted input.