Quick answers
- Is CVE-2026-107248 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-107248 being exploited in the wild.
- How severe is CVE-2026-107248?
- High severity, with a CVSS score of 8.8, published 12 October 2026.
- Which products and versions are affected?
- Thelia 3.0.0; Thelia Twig-Engine-Module before 1.0.9.
- Is there a fix for CVE-2026-107248?
- Yes: fixed in thelia/twig-engine-module 1.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-107248 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-107248?
- Check whether you run Thelia or Thelia Twig-Engine-Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: thelia/twig-engine-module 1.0.9
Technical details
The twig-engine-module in Thelia 3.0.0 fails to sandbox Twig template input in the Messages feature, allowing authenticated users with the "Messages" permission to inject unsanitized Twig expressions that compile and execute as raw PHP code. This server-side template injection (SSTI) vulnerability enables arbitrary PHP function execution, file read/write operations, and complete application compromise. The vulnerability is patched in thelia/twig-engine-module version 1.0.9.
Affected products
- Thelia Thelia 3.0.0
- Thelia twig-engine-module before 1.0.9
Timeline
- 2026-10-12: disclosed