CVE-2026-107248

The Thelia 3.0.0 back-office Email/Messages feature is vulnerable to a server-side template injection (SSTI) flaw. This vulnerability allows any authenticated user with the “Messages” permission to provide unsandboxed Twig templates , which are compiled and executed as raw code. An attacker can e...