The vulnerability exists in Thelia v2.6.0, where authenticated administrators can upload and install modules through a ZIP upload feature. The system does not validate or sandbox the PHP code that may be embedded in a module's install() method. An attacker who can upload a crafted module will cause that code to execute with the privileges of the web server during installation, resulting in remote code execution.

Affected vendor is Thelia. The specific product is Thelia CMS version 2.6.0. No other affected versions are listed.

This flaw requires the attacker to have legitimate administrator credentials to access the module upload interface. Once privileged, the attacker can deliver malicious PHP that runs on the server, providing full control of the application. The absence of EPSS data precludes a precise estimate of exploitation likelihood, but the capability for remote code execution and high privilege level indicates a high risk. The vulnerability is not currently listed in CISA KEV, yet it remains a critical concern for systems running Thelia 2.6.0.