CVE-2026-103537
Quick assessment
Affected
Thelia Thelia
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Thelia 2.6.1 在 Smarty 模板处理中存在绝对路径遍历漏洞，可导致服务器端模板注入（SSTI）及远程代码执行（RCE）。 验证函数虽然限制了相对目录遍历序列（如 ），但并未拒绝绝对路径。这使得经过身份验证的用户可以提供一个任意的文件系统路径作为模板。随后，Smarty 会加载并编译该引用文件，且缺乏有效的安全策略。因此，根据文件系统布局和部署配置的不同，文件中的模板代码可能以 Web 服务器的权限执行。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103537
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CVE-2026-103537
Source: CVE Program / CVE List V5
Vulnerability Description
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-103537
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103537
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-103537 (1)
Same Patch Batch · Thelia · 2026-10-12 · 13 CVEs total
| CVE-2026-109397 | 7.2 HIGH | Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space |
| CVE-2026-109396 | 4.2 MEDIUM | Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports |
| CVE-2026-103521 | CVE-2026-103521 | |
| CVE-2026-103524 | CVE-2026-103524 | |
| CVE-2026-103523 | CVE-2026-103523 | |
| CVE-2026-103522 | CVE-2026-103522 | |
| CVE-2026-103526 | CVE-2026-103526 | |
| CVE-2026-103529 | CVE-2026-103529 | |
| CVE-2026-103528 | CVE-2026-103528 | |
| CVE-2026-103527 | CVE-2026-103527 | |
| CVE-2026-103535 | CVE-2026-103535 | |
| CVE-2026-107248 | CVE-2026-107248 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-103537
No comments yet