Get real-time updates on Telegram
Verified
CVE-2026-107248: Thelia 3.0.0
Affected technology
Thelia · 3.0.0
Thelia
Component: Not specified by the source
What an attacker can do
Any authenticated user with the “Messages” permission can supply unsandboxed Twig templates, which are then compiled and executed as raw code.
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-12 16:54:24.294989+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-107248.html