CVE-2026-107248

HighCVSS 8.8/10Last modified Oct 15, 2026

Description

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-1336

Affected software

VendorProductVersions
TheliaThelia3.0.0

References

Timeline

Published
Oct 12, 2026
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1072499.8Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. TCVE-2026-107257.5Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size CVE-2026-1072505.9Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.CVE-2026-1072516.5Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects EntitCVE-2026-1072525.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allowCVE-2026-1072535.9Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.CVE-2026-1072544.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication BypassCVE-2026-1072557.3Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versiCVE-2026-1072565.3Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versiCVE-2026-1072576.5Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0CVE-2026-1072585.4Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form DiCVE-2026-1072595.4Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue
CVE-2026-107248: High severity, CVSS 8.8 | Vulnix