AI analysis
Thelia 2.6.0 renders its email templates with Smarty without disabling or sandboxing dangerous PHP functions, so the template engine can invoke system(), exec(), file_put_contents(), and file_get_contents(). An authenticated administrator can inject malicious Smarty expressions through the messages (email template) configuration interface, and the payload executes with the privileges of the web server process when the template is previewed or rendered. Successful exploitation yields arbitrary OS command execution plus arbitrary file read/write, i.e., full remote code execution on the underlying server, though it requires an administrator-level account or a compromised admin session. Deployments of Thelia 2.6.0 are directly named, and the related CERT-FR advisory VU#162329 covers multiple vulnerabilities in Thelia 2.6.0 and 2.6.1. The CVE is not yet CVSS-scored, there is no public proof of concept, it is not in the CISA KEV catalog, and no exploitation in the wild is known.
What to do: Apply the vendor fix referenced in CERT-FR advisory VU#162329 as soon as it is released, since no fixed version number has been published yet. As an interim mitigation, restrict Smarty's enabled PHP functions (disable system, exec, file_put_contents, file_get_contents), audit all configured email/message templates for injected Smarty expressions, and harden admin accounts (strong credentials, MFA) since exploitation requires administrator privileges. Review web server logs and the filesystem for signs of prior abuse such as unexpected files or command execution.
Affected
| Thelia (open-source PHP e-commerce CMS) | 2.6.0 (named in this CVE); related advisory VU#162329 also covers 2.6.1 |
Estimated exposure
niche≈ low thousands of live storefronts (order of 1,000–5,000 Thelia sites, only a subset on 2.6.x) — Thelia is a niche French open-source e-commerce CMS, and web-technology fingerprinting surveys (e.g., BuiltWith/PublicWWW) typically identify only a few thousand live Thelia-powered sites internet-wide.
Description
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.