CVE-2026-103528
Quick assessment
Affected
Thelia Thelia
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Thelia 2.6.0 在使用 Smarty 作为邮件模板引擎时，未对危险的 PHP 函数进行适当的访问限制。已认证的管理员可以通过消息配置接口向邮件模板中注入恶意的 Smarty 表达式；当模板被预览或渲染时，可执行如 system()、exec()、file_put_contents() 和 file_get_contents() 等函数，且这些函数将以 Web 进程的权限运行。此漏洞可导致任意操作系统命令执行、文件读写操作，并最终实现对底层服务器的远程代码执行（RCE）。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103528
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CVE-2026-103528
Source: CVE Program / CVE List V5
Vulnerability Description
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-103528
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103528
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-103528 (1)
Same Patch Batch · Thelia · 2026-10-12 · 13 CVEs total
| CVE-2026-109397 | 7.2 HIGH | Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space |
| CVE-2026-109396 | 4.2 MEDIUM | Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports |
| CVE-2026-103521 | CVE-2026-103521 | |
| CVE-2026-103524 | CVE-2026-103524 | |
| CVE-2026-103523 | CVE-2026-103523 | |
| CVE-2026-103522 | CVE-2026-103522 | |
| CVE-2026-103526 | CVE-2026-103526 | |
| CVE-2026-103529 | CVE-2026-103529 | |
| CVE-2026-103537 | CVE-2026-103537 | |
| CVE-2026-103527 | CVE-2026-103527 | |
| CVE-2026-103535 | CVE-2026-103535 | |
| CVE-2026-107248 | CVE-2026-107248 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-103528
No comments yet