Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-109397 (GCVE-0-2026-109397)

Vulnerability from nvd – Published: 2026-10-12 15:16 – Updated: 2026-10-13 16:57

Title

Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

Summary

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 16:40 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5953 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/thelia/thelia/security/advisor…	vendor-advisory
https://github.com/thelia/thelia/commit/6b706f5cb…	patch
https://github.com/thelia/thelia/commit/b71258902…	patch
https://github.com/thelia/thelia/blob/3.2.0/core/…	technical-description
https://github.com/thelia/thelia/releases/tag/3.1.2	release-notes
https://github.com/thelia/thelia/releases/tag/3.2.1	release-notes
https://www.vulncheck.com/advisories/thelia-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , < 3.1.2 (semver) Affected: 3.2.0 , < 3.2.1 (semver)

Date Public

2026-10-06 10:16

Credits

HunterSploit

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T16:40:48.601402Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:57:16.106Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/thelia/thelia",
          "product": "Thelia",
          "repo": "https://github.com/thelia/thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThan": "3.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2.1",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HunterSploit"
        }
      ],
      "datePublic": "2026-10-06T10:16:07.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T15:16:43.107Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5524-qfxp-33v9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/thelia/thelia/security/advisories/GHSA-5524-qfxp-33v9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/thelia/thelia/commit/6b706f5cb96e6b12d890c6d16edb1c9d1fd8191a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/thelia/thelia/commit/b71258902b5dd278007d0f37ddad45f76d06d5bc"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/File/Service/FileProcessorService.php#L119-L160"
        },
        {
          "name": "Thelia 3.1.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/thelia/thelia/releases/tag/3.1.2"
        },
        {
          "name": "Thelia 3.2.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/thelia/thelia/releases/tag/3.2.1"
        },
        {
          "name": "VulnCheck Advisory: Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-file-upload-rce-via-filename-trailing-space"
        }
      ],
      "title": "Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109397",
    "datePublished": "2026-10-12T15:16:43.107Z",
    "dateReserved": "2026-10-12T14:40:48.115Z",
    "dateUpdated": "2026-10-13T16:57:16.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109396 (GCVE-0-2026-109396)

Vulnerability from nvd – Published: 2026-10-12 15:16 – Updated: 2026-10-13 15:22

Title

Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Summary

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 15:21 UTC

CWE

CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5953 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/thelia/thelia/security/advisor…	vendor-advisory
https://github.com/thelia/thelia/commit/c00a26f06…	patch
https://github.com/thelia/thelia/commit/6e4605922…	patch
https://github.com/thelia/thelia/blob/3.2.0/core/…	technical-description
https://github.com/thelia/thelia/releases/tag/3.1.2	release-notes
https://github.com/thelia/thelia/releases/tag/3.2.1	release-notes
https://www.vulncheck.com/advisories/thelia-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , < 3.1.2 (semver) Affected: 3.2.0 , < 3.2.1 (semver)

Date Public

2026-10-06 10:17

Credits

HunterSploit

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109396",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:21:28.032308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T15:22:23.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/thelia/thelia",
          "product": "Thelia",
          "repo": "https://github.com/thelia/thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThan": "3.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2.1",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HunterSploit"
        }
      ],
      "datePublic": "2026-10-06T10:17:07.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator\u0027s spreadsheet application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1236",
              "description": "Improper Neutralization of Formula Elements in a CSV File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T15:16:41.909Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-gcgv-f8rf-w2wc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wc"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/thelia/thelia/commit/c00a26f0631ed9de3c4466176db6e808a25034aa"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/thelia/thelia/commit/6e46059225d87565caf4859ec0f764354e82ce95"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/Serializer/Serializer/CSVSerializer.php"
        },
        {
          "name": "Thelia 3.1.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/thelia/thelia/releases/tag/3.1.2"
        },
        {
          "name": "Thelia 3.2.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/thelia/thelia/releases/tag/3.2.1"
        },
        {
          "name": "VulnCheck Advisory: Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-csv-formula-injection-via-exports"
        }
      ],
      "title": "Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109396",
    "datePublished": "2026-10-12T15:16:41.909Z",
    "dateReserved": "2026-10-12T14:40:47.844Z",
    "dateUpdated": "2026-10-13T15:22:23.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107248 (GCVE-0-2026-107248)

Vulnerability from nvd – Published: 2026-10-12 15:06 – Updated: 2026-10-12 15:06

Title

CVE-2026-107248

Summary

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.

Severity

No CVSS data available.

CWE

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 3.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia 3.0.0\u0027s back-office Email/Messages feature contains a server\u2011side template injection (SSTI) flaw that allows any authenticated user with the \u201cMessages\u201d permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T15:06:55.302Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-107248",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-107248"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-107248",
    "datePublished": "2026-10-12T15:06:55.302Z",
    "dateReserved": "2026-10-07T15:19:06.002Z",
    "dateUpdated": "2026-10-12T15:06:55.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103537 (GCVE-0-2026-103537)

Vulnerability from nvd – Published: 2026-10-12 14:56 – Updated: 2026-10-12 14:56

Title

CVE-2026-103537

Summary

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.

Severity

No CVSS data available.

CWE

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server\u0027s privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:56:21.364Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103537",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103537"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103537",
    "datePublished": "2026-10-12T14:56:21.364Z",
    "dateReserved": "2026-09-30T19:07:13.961Z",
    "dateUpdated": "2026-10-12T14:56:21.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103535 (GCVE-0-2026-103535)

Vulnerability from nvd – Published: 2026-10-12 14:55 – Updated: 2026-10-12 14:55

Title

CVE-2026-103535

Summary

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.

Severity

No CVSS data available.

CWE

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file\u0027s write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web\u2011accessible paths. Separately, the translation\u2011writing logic does not escape `\\` in user\u2011supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web\u2011server\u2019s privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:55:58.210Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103535",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103535"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103535",
    "datePublished": "2026-10-12T14:55:58.210Z",
    "dateReserved": "2026-09-30T19:07:09.910Z",
    "dateUpdated": "2026-10-12T14:55:58.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103529 (GCVE-0-2026-103529)

Vulnerability from nvd – Published: 2026-10-12 14:55 – Updated: 2026-10-12 14:55

Title

CVE-2026-103529

Summary

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.

Severity

No CVSS data available.

CWE

CWE-434 Unrestricted Upload of File with Dangerous Type

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module\u0027s `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:55:38.419Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103529",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103529"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103529",
    "datePublished": "2026-10-12T14:55:38.419Z",
    "dateReserved": "2026-09-30T19:06:44.630Z",
    "dateUpdated": "2026-10-12T14:55:38.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103528 (GCVE-0-2026-103528)

Vulnerability from nvd – Published: 2026-10-12 14:55 – Updated: 2026-10-12 14:55

Title

CVE-2026-103528

Summary

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.

Severity

No CVSS data available.

CWE

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:55:14.883Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103528",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103528"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103528",
    "datePublished": "2026-10-12T14:55:14.883Z",
    "dateReserved": "2026-09-30T19:06:40.650Z",
    "dateUpdated": "2026-10-12T14:55:14.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103527 (GCVE-0-2026-103527)

Vulnerability from nvd – Published: 2026-10-12 14:54 – Updated: 2026-10-12 14:54

Title

CVE-2026-103527

Summary

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.

Severity

No CVSS data available.

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.0\u0027s Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the \u201cnext\u201d parameter, enabling reflected Cross\u2011Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker\u2011controlled JavaScript."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:54:53.807Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103527",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103527"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103527",
    "datePublished": "2026-10-12T14:54:53.807Z",
    "dateReserved": "2026-09-30T19:06:35.476Z",
    "dateUpdated": "2026-10-12T14:54:53.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103526 (GCVE-0-2026-103526)

Vulnerability from nvd – Published: 2026-10-12 14:54 – Updated: 2026-10-12 14:58

Title

CVE-2026-103526

Summary

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 14:58 UTC

CWE

CWE-204 Observable Response Discrepancy
CWE-204 - Observable Response Discrepancy

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-103526",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T14:58:37.804196Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-204",
                "description": "CWE-204 Observable Response Discrepancy",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T14:58:40.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-204 Observable Response Discrepancy",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:54:35.007Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103526",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103526"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103526",
    "datePublished": "2026-10-12T14:54:35.007Z",
    "dateReserved": "2026-09-30T19:06:30.711Z",
    "dateUpdated": "2026-10-12T14:58:40.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103524 (GCVE-0-2026-103524)

Vulnerability from nvd – Published: 2026-10-12 14:54 – Updated: 2026-10-12 14:54

Title

CVE-2026-103524

Summary

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.

Severity

No CVSS data available.

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store\u0027s product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:54:16.912Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103524",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103524"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103524",
    "datePublished": "2026-10-12T14:54:16.912Z",
    "dateReserved": "2026-09-30T19:05:23.379Z",
    "dateUpdated": "2026-10-12T14:54:16.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103523 (GCVE-0-2026-103523)

Vulnerability from nvd – Published: 2026-10-12 14:53 – Updated: 2026-10-12 14:53

Title

CVE-2026-103523

Summary

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.

Severity

No CVSS data available.

CWE

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the \u201cAdd New Address\u201d form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:53:54.845Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103523",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103523"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103523",
    "datePublished": "2026-10-12T14:53:54.845Z",
    "dateReserved": "2026-09-30T19:05:18.631Z",
    "dateUpdated": "2026-10-12T14:53:54.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103522 (GCVE-0-2026-103522)

Vulnerability from nvd – Published: 2026-10-12 14:53 – Updated: 2026-10-12 14:59

Title

CVE-2026-103522

Summary

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 14:59 UTC

CWE

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-20 Improper Input Validation
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-103522",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T14:59:38.844888Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T14:59:41.947Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client\u2011supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-20 Improper Input Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:53:34.695Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103522",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103522"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103522",
    "datePublished": "2026-10-12T14:53:34.695Z",
    "dateReserved": "2026-09-30T19:03:43.339Z",
    "dateUpdated": "2026-10-12T14:59:41.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103521 (GCVE-0-2026-103521)

Vulnerability from nvd – Published: 2026-10-12 14:52 – Updated: 2026-10-12 15:00

Title

CVE-2026-103521

Summary

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 15:00 UTC

CWE

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-103521",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T15:00:35.233527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T15:00:39.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:52:56.850Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103521",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103521"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103521",
    "datePublished": "2026-10-12T14:52:56.850Z",
    "dateReserved": "2026-09-30T19:03:23.929Z",
    "dateUpdated": "2026-10-12T15:00:39.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109397 (GCVE-0-2026-109397)

Vulnerability from cvelistv5 – Published: 2026-10-12 15:16 – Updated: 2026-10-13 16:57

Title

Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

Summary

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 16:40 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5953 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/thelia/thelia/security/advisor…	vendor-advisory
https://github.com/thelia/thelia/commit/6b706f5cb…	patch
https://github.com/thelia/thelia/commit/b71258902…	patch
https://github.com/thelia/thelia/blob/3.2.0/core/…	technical-description
https://github.com/thelia/thelia/releases/tag/3.1.2	release-notes
https://github.com/thelia/thelia/releases/tag/3.2.1	release-notes
https://www.vulncheck.com/advisories/thelia-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , < 3.1.2 (semver) Affected: 3.2.0 , < 3.2.1 (semver)

Date Public

2026-10-06 10:16

Credits

HunterSploit

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T16:40:48.601402Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:57:16.106Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/thelia/thelia",
          "product": "Thelia",
          "repo": "https://github.com/thelia/thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThan": "3.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2.1",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HunterSploit"
        }
      ],
      "datePublic": "2026-10-06T10:16:07.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T15:16:43.107Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5524-qfxp-33v9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/thelia/thelia/security/advisories/GHSA-5524-qfxp-33v9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/thelia/thelia/commit/6b706f5cb96e6b12d890c6d16edb1c9d1fd8191a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/thelia/thelia/commit/b71258902b5dd278007d0f37ddad45f76d06d5bc"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/File/Service/FileProcessorService.php#L119-L160"
        },
        {
          "name": "Thelia 3.1.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/thelia/thelia/releases/tag/3.1.2"
        },
        {
          "name": "Thelia 3.2.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/thelia/thelia/releases/tag/3.2.1"
        },
        {
          "name": "VulnCheck Advisory: Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-file-upload-rce-via-filename-trailing-space"
        }
      ],
      "title": "Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109397",
    "datePublished": "2026-10-12T15:16:43.107Z",
    "dateReserved": "2026-10-12T14:40:48.115Z",
    "dateUpdated": "2026-10-13T16:57:16.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109396 (GCVE-0-2026-109396)

Vulnerability from cvelistv5 – Published: 2026-10-12 15:16 – Updated: 2026-10-13 15:22

Title

Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

Summary

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 15:21 UTC

CWE

CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5953 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/thelia/thelia/security/advisor…	vendor-advisory
https://github.com/thelia/thelia/commit/c00a26f06…	patch
https://github.com/thelia/thelia/commit/6e4605922…	patch
https://github.com/thelia/thelia/blob/3.2.0/core/…	technical-description
https://github.com/thelia/thelia/releases/tag/3.1.2	release-notes
https://github.com/thelia/thelia/releases/tag/3.2.1	release-notes
https://www.vulncheck.com/advisories/thelia-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , < 3.1.2 (semver) Affected: 3.2.0 , < 3.2.1 (semver)

Date Public

2026-10-06 10:17

Credits

HunterSploit

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109396",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:21:28.032308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T15:22:23.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/thelia/thelia",
          "product": "Thelia",
          "repo": "https://github.com/thelia/thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThan": "3.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2.1",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HunterSploit"
        }
      ],
      "datePublic": "2026-10-06T10:17:07.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator\u0027s spreadsheet application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1236",
              "description": "Improper Neutralization of Formula Elements in a CSV File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T15:16:41.909Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-gcgv-f8rf-w2wc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wc"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/thelia/thelia/commit/c00a26f0631ed9de3c4466176db6e808a25034aa"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/thelia/thelia/commit/6e46059225d87565caf4859ec0f764354e82ce95"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/Serializer/Serializer/CSVSerializer.php"
        },
        {
          "name": "Thelia 3.1.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/thelia/thelia/releases/tag/3.1.2"
        },
        {
          "name": "Thelia 3.2.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/thelia/thelia/releases/tag/3.2.1"
        },
        {
          "name": "VulnCheck Advisory: Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-csv-formula-injection-via-exports"
        }
      ],
      "title": "Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109396",
    "datePublished": "2026-10-12T15:16:41.909Z",
    "dateReserved": "2026-10-12T14:40:47.844Z",
    "dateUpdated": "2026-10-13T15:22:23.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107248 (GCVE-0-2026-107248)

Vulnerability from cvelistv5 – Published: 2026-10-12 15:06 – Updated: 2026-10-12 15:06

Title

CVE-2026-107248

Summary

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.

Severity

No CVSS data available.

CWE

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 3.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia 3.0.0\u0027s back-office Email/Messages feature contains a server\u2011side template injection (SSTI) flaw that allows any authenticated user with the \u201cMessages\u201d permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T15:06:55.302Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-107248",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-107248"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-107248",
    "datePublished": "2026-10-12T15:06:55.302Z",
    "dateReserved": "2026-10-07T15:19:06.002Z",
    "dateUpdated": "2026-10-12T15:06:55.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103537 (GCVE-0-2026-103537)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:56 – Updated: 2026-10-12 14:56

Title

CVE-2026-103537

Summary

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.

Severity

No CVSS data available.

CWE

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server\u0027s privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:56:21.364Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103537",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103537"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103537",
    "datePublished": "2026-10-12T14:56:21.364Z",
    "dateReserved": "2026-09-30T19:07:13.961Z",
    "dateUpdated": "2026-10-12T14:56:21.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103535 (GCVE-0-2026-103535)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:55 – Updated: 2026-10-12 14:55

Title

CVE-2026-103535

Summary

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.

Severity

No CVSS data available.

CWE

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file\u0027s write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web\u2011accessible paths. Separately, the translation\u2011writing logic does not escape `\\` in user\u2011supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web\u2011server\u2019s privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:55:58.210Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103535",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103535"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103535",
    "datePublished": "2026-10-12T14:55:58.210Z",
    "dateReserved": "2026-09-30T19:07:09.910Z",
    "dateUpdated": "2026-10-12T14:55:58.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103529 (GCVE-0-2026-103529)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:55 – Updated: 2026-10-12 14:55

Title

CVE-2026-103529

Summary

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.

Severity

No CVSS data available.

CWE

CWE-434 Unrestricted Upload of File with Dangerous Type

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module\u0027s `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:55:38.419Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103529",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103529"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103529",
    "datePublished": "2026-10-12T14:55:38.419Z",
    "dateReserved": "2026-09-30T19:06:44.630Z",
    "dateUpdated": "2026-10-12T14:55:38.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103528 (GCVE-0-2026-103528)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:55 – Updated: 2026-10-12 14:55

Title

CVE-2026-103528

Summary

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.

Severity

No CVSS data available.

CWE

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:55:14.883Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103528",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103528"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103528",
    "datePublished": "2026-10-12T14:55:14.883Z",
    "dateReserved": "2026-09-30T19:06:40.650Z",
    "dateUpdated": "2026-10-12T14:55:14.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103527 (GCVE-0-2026-103527)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:54 – Updated: 2026-10-12 14:54

Title

CVE-2026-103527

Summary

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.

Severity

No CVSS data available.

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.0\u0027s Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the \u201cnext\u201d parameter, enabling reflected Cross\u2011Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker\u2011controlled JavaScript."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:54:53.807Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103527",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103527"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103527",
    "datePublished": "2026-10-12T14:54:53.807Z",
    "dateReserved": "2026-09-30T19:06:35.476Z",
    "dateUpdated": "2026-10-12T14:54:53.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103526 (GCVE-0-2026-103526)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:54 – Updated: 2026-10-12 14:58

Title

CVE-2026-103526

Summary

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 14:58 UTC

CWE

CWE-204 Observable Response Discrepancy
CWE-204 - Observable Response Discrepancy

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-103526",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T14:58:37.804196Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-204",
                "description": "CWE-204 Observable Response Discrepancy",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T14:58:40.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-204 Observable Response Discrepancy",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:54:35.007Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103526",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103526"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103526",
    "datePublished": "2026-10-12T14:54:35.007Z",
    "dateReserved": "2026-09-30T19:06:30.711Z",
    "dateUpdated": "2026-10-12T14:58:40.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103524 (GCVE-0-2026-103524)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:54 – Updated: 2026-10-12 14:54

Title

CVE-2026-103524

Summary

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.

Severity

No CVSS data available.

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store\u0027s product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:54:16.912Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103524",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103524"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103524",
    "datePublished": "2026-10-12T14:54:16.912Z",
    "dateReserved": "2026-09-30T19:05:23.379Z",
    "dateUpdated": "2026-10-12T14:54:16.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103523 (GCVE-0-2026-103523)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:53 – Updated: 2026-10-12 14:53

Title

CVE-2026-103523

Summary

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.

Severity

No CVSS data available.

CWE

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the \u201cAdd New Address\u201d form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:53:54.845Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103523",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103523"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103523",
    "datePublished": "2026-10-12T14:53:54.845Z",
    "dateReserved": "2026-09-30T19:05:18.631Z",
    "dateUpdated": "2026-10-12T14:53:54.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103522 (GCVE-0-2026-103522)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:53 – Updated: 2026-10-12 14:59

Title

CVE-2026-103522

Summary

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 14:59 UTC

CWE

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-20 Improper Input Validation
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-103522",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T14:59:38.844888Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T14:59:41.947Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client\u2011supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-20 Improper Input Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:53:34.695Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103522",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103522"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103522",
    "datePublished": "2026-10-12T14:53:34.695Z",
    "dateReserved": "2026-09-30T19:03:43.339Z",
    "dateUpdated": "2026-10-12T14:59:41.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103521 (GCVE-0-2026-103521)

Vulnerability from cvelistv5 – Published: 2026-10-12 14:52 – Updated: 2026-10-12 15:00

Title

CVE-2026-103521

Summary

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-12 15:00 UTC

CWE

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 156 records in the last 180 days details

References

1 reference

URL	Tags
https://kb.cert.org/vuls/id/162329

Impacted products

1 product

Vendor	Product	Version
Thelia	Thelia	Affected: 0 , ≤ 2.6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-103521",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T15:00:35.233527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T15:00:39.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thelia",
          "vendor": "Thelia",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T14:52:56.850Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/162329"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2026-103521",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-103521"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-103521",
    "datePublished": "2026-10-12T14:52:56.850Z",
    "dateReserved": "2026-09-30T19:03:23.929Z",
    "dateUpdated": "2026-10-12T15:00:39.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

26 vulnerabilities by Thelia

CVE-2026-109397 (GCVE-0-2026-109397)

CVE-2026-109396 (GCVE-0-2026-109396)

CVE-2026-107248 (GCVE-0-2026-107248)

CVE-2026-103537 (GCVE-0-2026-103537)

CVE-2026-103535 (GCVE-0-2026-103535)

CVE-2026-103529 (GCVE-0-2026-103529)

CVE-2026-103528 (GCVE-0-2026-103528)

CVE-2026-103527 (GCVE-0-2026-103527)

CVE-2026-103526 (GCVE-0-2026-103526)

CVE-2026-103524 (GCVE-0-2026-103524)

CVE-2026-103523 (GCVE-0-2026-103523)

CVE-2026-103522 (GCVE-0-2026-103522)

CVE-2026-103521 (GCVE-0-2026-103521)

CVE-2026-109397 (GCVE-0-2026-109397)

CVE-2026-109396 (GCVE-0-2026-109396)

CVE-2026-107248 (GCVE-0-2026-107248)

CVE-2026-103537 (GCVE-0-2026-103537)

CVE-2026-103535 (GCVE-0-2026-103535)

CVE-2026-103529 (GCVE-0-2026-103529)

CVE-2026-103528 (GCVE-0-2026-103528)

CVE-2026-103527 (GCVE-0-2026-103527)

CVE-2026-103526 (GCVE-0-2026-103526)

CVE-2026-103524 (GCVE-0-2026-103524)

CVE-2026-103523 (GCVE-0-2026-103523)

CVE-2026-103522 (GCVE-0-2026-103522)

CVE-2026-103521 (GCVE-0-2026-103521)