Thelia version 2.6.1 has a combined path traversal and PHP code injection flaw in its translation editor. The editor uses an unvalidated item_name parameter to create the path for translation files, allowing an attacker to write files outside the expected templates directory. A separate issue in the translation-writing logic fails to escape backslashes in user input, enabling the injection of executable PHP code into the translation file. When these two weaknesses are chained, an authenticated user with UPDATE rights on admin.configuration.language can create a PHP file in a web‑accessible location and trigger remote code execution with the web‑server’s privileges.

This vulnerability affects Thelia 2.6.1 and any installations running that exact version without applying later fixes. No other Thelia releases are identified as affected in the current advisory.

The vulnerability provides a remote code execution path for authenticated users, representing a high impact. The CVSS score is not provided, and the EPSS score is unavailable; however, the exploitation vector does not require privileged access beyond existing user permissions, increasing the likelihood of use. The vulnerability is not listed in CISA KEV catalog, but the lack of public exploitation data must not lower the urgency of remediation.