CVE-2026-103537

Thelia 2.6.1 absolute path traversal in Smarty template handling. The checkTemplate() validation blocks relative traversal like ../ but does not reject absolute paths.

nvd.nist.gov/vuln/detail/...

#CVE #Thelia #PathTraversal #SSTI

Bug Bounty Tip: SSTI via Template Fields

Look for:

GET /search?q=test or POST /profile fields reflected in emails, PDFs, or pages.

Test with: {{7*7}}, ${7*7}, <%= 7*7 %>, #{7*7}

For more tips join our Telegram channel: t.me/bugbountyusa

#BugBounty #SSTI #RCE #TemplateInjection #InfoSec

Ademi LLP Investigates Fairness of SouthThinking Acquisition Valuation #None #Ademi_LLP #SouthThinking #SSTI

#SSTI SoundThinking to be Acquired by Transom Capital Group

https://www.stocktitan.net/news/SSTI/sound-thinking-to-be-acquired-by-transom-capital-y7g3wdqqe7cf.html?utm_source=stocktitan-bluesky&utm_medium=social

A critical Prompty vulnerability (CVE-2026-73299, CVSS 10) let a crafted .prompty file escape the template engine and run arbitrary JavaScript in Node.js.

#Prompty #Microsoft #SSTI #RCE #CVE202673299