https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-14T18:22:23.704113+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-109397 CVE-2026-109397 — Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space 2026-10-14T18:22:23.706102+00:00

Affected: Thelia

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.