Description
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.
Published: 2026-10-12
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via arbitrary file upload
Action: Immediate Patch
AI Analysis

Impact

In Thelia v2.6.0 the document‑update endpoint does not enforce file‑type validation. This allows an attacker with administrative privileges to upload executable files such as PHP scripts, enabling the execution of arbitrary code on the underlying web server. The flaw is classified as CWE‑434.

Affected Systems

The vulnerability affects Thelia version 2.6.0 and applies to all deployments of this release that use the document‑update feature.

Risk and Exploitability

The CVSS score of 7.2 indicates moderate‑to‑high severity. The EPSS score is unavailable, and it is not listed in CISA KEV. The attack requires administrative rights; therefore the risk is highest when admin credentials are compromised or poorly protected. If such privileges are obtained, the attacker can release malicious code and achieve remote execution.

Generated by OpenCVE AI on October 12, 2026 at 16:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official vendor patch that enforces file‑type validation on the document‑update endpoint (check for newer releases such as 2.6.1 or later).
  • If a patch is not yet available, temporarily configure the application or web server to reject executable file types (e.g., MIME type or extension filtering) for the document‑update path, effectively disabling the upload of PHP or other scripts.
  • Immediately review, download, and remove any files that were stored through the vulnerable endpoint, and confirm that no malicious code remains on the server.

Generated by OpenCVE AI on October 12, 2026 at 16:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://kb.cert.org/vuls/id/162329 cve-icon cve-icon
History

Tue, 13 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Thelia
Thelia thelia
Vendors & Products Thelia
Thelia thelia

Mon, 12 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-434
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.
Title CVE-2026-103521
References

Subscriptions

Thelia Thelia
cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2026-10-12T15:00:39.229Z

Reserved: 2026-09-30T19:03:23.929Z

Link: CVE-2026-103521

cve-icon Vulnrichment

Updated: 2026-10-12T15:00:31.494Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T15:17:05.503

Modified: 2026-10-13T13:51:00.250

Link: CVE-2026-103521

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:55:30Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type