In Thelia version 2.6.0, a flaw in the store banner upload feature allows insufficient file type validation because the application only trusts client‑supplied MIME types. An administrator can upload a PHP script disguised as an image file; when the server saves it, the script is executed, providing remote code execution on the underlying web server.

The affected product is Thelia, specifically the 2.6.0 release. Any deployment of Thelia 2.6.0 that uses the banner upload functionality and grants administrative access to upload files is vulnerable.

The CVSS score of 7.2 indicates a high severity severity. The EPSS score is unavailable, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector requires administrative privileges, but once achieved, the attacker can run arbitrary code. Because the flaw relies on a configuration that accepts all MIME types, proper server‑side file type validation would mitigate exploitation.