Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the… (CVE-2026-107248)
Description
Thelia 3.0.0 contains a server-side template injection (SSTI) vulnerability in its back-office Email/Messages feature. Authenticated users with the Messages permission can supply unsandboxed Twig templates, which are executed as raw code. This allows execution of arbitrary PHP functions, reading sensitive files, and potentially writing to the filesystem, risking full application and host compromise. The vulnerability is patched in thelia/twig-engine-module version 1.0.9.
Affected software
pkg:github/thelia/twig-engine-moduleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Thelia 3.0.0's back-office Email/Messages feature has a server-side template injection flaw (CVE-2026-107248) that permits any authenticated user with the Messages permission to submit unsandboxed Twig templates. These templates are compiled and executed as raw PHP code, enabling attackers to run arbitrary PHP functions, access sensitive files, and write to the filesystem. This can lead to complete compromise of the application and the underlying host system. The issue has been addressed in thelia/twig-engine-module version 1.0.9.
Potential Impact
Exploitation allows authenticated users with Messages permission to execute arbitrary PHP code, read sensitive files, and write to the filesystem, potentially resulting in full compromise of the Thelia application and its host environment.
Mitigation Recommendations
A patch is available in thelia/twig-engine-module version 1.0.9. Users should upgrade to this version to remediate the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-25fx-hhx2-xwq3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-107248"]
Threat ID: 6acd55592cdf04f656da85b9
Added to database: 10/12/2026, 21:47:05 UTC
Last enriched: 10/12/2026, 22:00:27 UTC
Last updated: 10/12/2026, 22:48:18 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.