Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. (CVE-2026-103537)

The vulnerability in Thelia 2.6.1 arises from insufficient validation in the checkTemplate() function, which blocks relative directory traversal sequences but does not reject absolute paths. An authorized user can exploit this by providing an absolute path to a template file. Smarty then loads and compiles this file without enforcing a security policy, which depending on the deployment environment, can lead to execution of arbitrary template code and remote code execution under the web server's user context.

Successful exploitation can lead to remote code execution on the web server with the privileges of the web server process. This can compromise the affected system, potentially allowing attackers to execute arbitrary commands, access sensitive data, or pivot within the network. The vulnerability requires an authorized user to supply the malicious input, limiting exposure to authenticated attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authorized users only and monitor for suspicious template file usage. Avoid supplying untrusted input to template paths. Follow vendor updates for patches or official mitigations.