VulnSocial

CVE-2026-103537

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94CWE-1336

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-15: 110-15
Referenced assets1 URL
By indicator
Full discourse1 post
  • Abhinav Singwal@yogsec

    CVE-2026-103537 Thelia 2.6.1 absolute path traversal in Smarty template handling. The checkTemplate() validation blocks relative traversal like ../ but does not reject absolute paths. An authorized user can supply an arbitrary filesystem path as a template. Smarty loads and compiles the file without an effective security policy, enabling server-side template injection and remote code execution with web server privileges. Fixed in 2.6.2. CWE-22 Path Traversal. https://nvd.nist.gov/vuln/detail/CVE-2026-103537 #CVE #Thelia #PathTraversal #SSTI

    0000037
    527 followersView on X

Explore more

Back to dashboard