CVE-2026-103537

Executive Summary

CVE-2026-103537 is an absolute path traversal vulnerability in Thelia 2.6.1's Smarty template handling, which permits Server-Side Template Injection (SSTI) and ultimately remote code execution (RCE). An authorized user can supply an arbitrary filesystem path as a template, bypassing the checkTemplate() validation that only blocks relative traversal sequences like ../. Successful exploitation allows template code execution with the web server's privileges, compromising the application and potentially the underlying host.

Technical Analysis

The vulnerability resides in the template management functionality of Thelia 2.6.1, an open-source e-commerce platform built on PHP and the Smarty templating engine. The core flaw is an incomplete path traversal defense within the checkTemplate() validation routine. This function is designed to prevent directory traversal attacks by rejecting relative sequences such as ../. However, it fails to account for absolute paths (e.g., /etc/passwd, /var/www/html/uploaded_file.tpl). Because the validation only blocks relative traversal, an attacker who can reach the template selection or override mechanism can supply a full filesystem path. Smarty subsequently loads and compiles the referenced file without an effective security policy. This allows an attacker to point Smarty at a file they control—such as an uploaded image, log, or configuration file containing Smarty template syntax—or at a system file that can be coerced into template execution. The absence of a Smarty security policy means dangerous template constructs (e.g., {php} tags in older Smarty versions, or custom modifiers and functions) are not restricted, enabling SSTI that escalates to remote code execution. The vulnerability requires an "authorized user" context, implying a valid account with sufficient privileges to access the template selection feature, but the exact privilege level (e.g., administrator, template editor) is not specified in the available data. The affected component is the template handling subsystem, and the attack surface is the web interface or API endpoint that accepts template path parameters. No specific function names beyond checkTemplate() are provided.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance and Target Identification: The attacker identifies a Thelia 2.6.1 instance, likely through Shodan scans using dorks for "Thelia" in page titles or HTML content. They must possess valid credentials for an authorized user account—obtained via prior compromise, default credentials, or legitimate provisioning.

2. Triggering the Flaw: The attacker navigates to the template management interface (exact URL not specified) and submits a template path parameter. Instead of a relative path containing ../, they provide an absolute path, such as /var/www/html/thelia/upload/evil.tpl or /tmp/evil.tpl. The checkTemplate() validation passes because it only inspects for relative traversal sequences. Smarty then attempts to load and compile the file at the absolute path.

3. Payload and Execution Method: The attacker must ensure a file exists at the chosen absolute path that contains Smarty template syntax. This could be achieved by uploading a file through another feature (e.g., product image upload, log poisoning, or session file manipulation) with a .tpl extension or a double extension. Alternatively, if a writable system path is predictable, they may use another vector to place the file. Once Smarty compiles the file, the embedded template code executes. The NVD description notes that "template code in the file can be executed with the web server's privileges." At the vulnerability-class level, this is SSTI leading to RCE—likely via Smarty's ability to execute PHP functions or include arbitrary PHP code if security policies are absent. The exact Smarty syntax for RCE is not detailed in the provided data, but typical Smarty SSTI payloads exploit {php} tags or {system()}-style function calls in older or misconfigured versions.

4. Post-Exploitation Impact: Successful exploitation grants the attacker code execution as the web server user (e.g., www-data, apache). This allows reading sensitive configuration files (database credentials, API keys), writing webshells, pivoting to internal services, or full server compromise. Given the e-commerce context, this could lead to theft of customer data, payment card skimming, or ransomware deployment.

Impact Assessment

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a high-severity vulnerability. The attack is network-accessible (AV:N), requires low complexity (AC:L), and needs low privileges (PR:L)—aligning with the "authorized user" requirement. No user interaction is needed (UI:N). The scope is unchanged (S:U), but confidentiality, integrity, and availability impacts are all high (C:H/I:H/A:H). Business impact for an e-commerce platform like Thelia is severe: attackers can achieve remote code execution, leading to data breaches, financial fraud, defacement, or full system takeover. The blast radius includes the application server, any connected databases, and potentially the underlying operating system. Because the vulnerability is unpatched (confidence 0/4), all Thelia 2.6.1 deployments are at risk until mitigations are applied. The EPSS score is not yet available, and CISA KEV does not list this CVE, but the absence of public exploitation does not reduce the criticality.

Detection Guidance

Sigma Rule

title: Thelia Smarty Template Absolute Path Traversal
id: 8f9c2e1a-4b3d-4f7e-9a2c-1d5e8f3b7a6c
status: experimental
description: Detects attempts to exploit CVE-2026-103537 by supplying absolute paths to Thelia's template handling.
author: valtersit.com
date: 2026-05-20
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-uri-query|contains:
      - 'template=/' 
      - 'template=%2F'
      - 'tpl=/'
      - 'tpl=%2F'
      - 'view=/'
      - 'view=%2F'
  condition: selection
falsepositives:
  - Legitimate administrative use of absolute paths (rare)
level: high
tags:
  - attack.t1190
  - cve.2026-103537

YARA Rule

rule CVE_2026_103537_Thelia_Smarty_SSTI
{
    meta:
        description = "Detects Smarty template files with suspicious PHP execution patterns indicating SSTI exploitation"
        author = "valtersit.com"
        date = "2026-05-20"
        reference = "CVE-2026-103537"
        severity = "high"
    strings:
        $s1 = "{php}" ascii wide nocase
        $s2 = "{/php}" ascii wide nocase
        $s3 = "system(" ascii wide nocase
        $s4 = "exec(" ascii wide nocase
        $s5 = "passthru(" ascii wide nocase
        $s6 = "shell_exec(" ascii wide nocase
        $s7 = "base64_decode(" ascii wide nocase
        $s8 = "eval(" ascii wide nocase
    condition:
        uint32(0) == 0x7B2A2420 or // Smarty template starting with "{*$ "
        $s1 or $s2 or (2 of ($s3, $s4, $s5, $s6, $s7, $s8))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103537 Thelia Absolute Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin/"; http_uri; content:"template="; http_uri; pcre:"/(template|tpl|view)=(\/|%2F)[^\&]*/Ui"; reference:cve,2026-103537; reference:url,valtersit.com; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.name in ("php", "php-fpm", "apache2", "httpd")]
  [file where file.path : ("/tmp/*.tpl", "/var/www/*.tpl", "/uploads/*.tpl") and event.action == "creation"]

Splunk SPL Query

index=web sourcetype=access_combined
| search (uri_query="*template=/*" OR uri_query="*tpl=/*" OR uri_query="*view=/*" OR uri_query="*template=%2F*" OR uri_query="*tpl=%2F*" OR uri_query="*view=%2F*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,app,thelia,">
  <rule id="100100" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>template=|tpl=|view=</url>
    <regex>template=\/|tpl=\/|view=\/|template=%2F|tpl=%2F|view=%2F</regex>
    <description>CVE-2026-103537: Thelia absolute path traversal attempt detected in web request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_103537,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable or restrict access to template management features for non-administrative users.
   • Implement a Web Application Firewall (WAF) rule to block absolute paths in template-related parameters (e.g., reject requests where template, tpl, or view parameters contain a leading / or %2F).
   • Ensure Smarty's security policy is enabled and configured to restrict dangerous functions. Apply $smarty->security_policy with a whitelist of allowed functions and directories.
   • Monitor web server logs for suspicious template path parameters and file creation in writable directories.

2. Patch/Upgrade Steps:

   • No official patch is available. Monitor the Thelia project's repository and security advisories for updates.
   • As a temporary workaround, modify checkTemplate() to reject absolute paths by validating that the supplied path is within an allowed base directory (e.g., using realpath() and comparing against a whitelist). This requires custom code changes and thorough testing.

3. Long-Term Hardening:

   • Adopt a secure-by-design approach: avoid accepting user-supplied filesystem paths; instead, use indirect references (e.g., template IDs) mapped to a predefined set of templates.
   • Implement strict input validation and canonicalization for all file path parameters.
   • Enforce the principle of least privilege for the web server user; run PHP under a dedicated user with minimal filesystem write access.
   • Regularly audit and update third-party libraries (Smarty) to the latest secure versions.
   • Conduct security code reviews focusing on path traversal and template injection flaws.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103537
• Thelia Official Website: https://thelia.net
• OWASP Path Traversal: https://owasp.org/www-community/attacks/Path_Traversal
• OWASP Server-Side Template Injection: https://owasp.org/www-community/attacks/Server-Side_Template_Injection
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.