CVE-2026-107248

HighCVSS 8.8/10Last modified Oct 15, 2026

Description

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-1336

Affected software

No affected versions have been published.

Timeline

Published: Oct 12, 2026
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-107257.5Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size CVE-2026-107266.8Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the CVE-2026-1072693.7Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate v CVE-2026-107277.2An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker CVE-2026-1072707.1Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' CVE-2026-1072715.3Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofi CVE-2026-1072724.7Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning CVE-2026-1072734.3Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach l CVE-2026-1072756.8@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore CVE-2026-1072766.3MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are CVE-2026-1072785.3MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored corre CVE-2026-1072798.8The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0