CVE-2026-103537
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution.
Published Oct 12, 2026 · updated Oct 15, 2026 · CERT/CC
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The validation restricts relative directory traversal sequences such as but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · CERT/CC Vulnerability Notes
Detected
Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose
Oct 15, 2026 · NIST NVD
Updated
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The validation restricts relative directory traversal sequences such as but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effectiv
Sources
- CERT/CC Vulnerability NotesGovernment advisoryCVE-2026-103537
Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template inje
kb.cert.org - CVE.orgVulnerability recordCVE-2026-103537
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-103537
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The validation restricts relative directory traversal sequences such as but does not reject absolute paths, allowing
nvd.nist.gov