CVE WATCH / VULNERABILITY DETAIL
CVE-2026-103528
UNKNOWNCVSS 0NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-103529
- CVE-2026-103535
- CVE-2026-103521 HIGH 7.2
- CVE-2026-103522 HIGH 7.2
- CVE-2026-12613 HIGH 8.8
- CVE-2026-52903 HIGH 8.8
- CVE-2026-109187 MEDIUM 6.5
- CVE-2026-108834 MEDIUM 4.3
- CVE-2026-85499
- CVE-2026-108827 MEDIUM 4.1