The vulnerability in Thelia, a CWE-434: Unrestricted File Upload flaw, allows an authenticated back‑office user to upload a PHP file by adding a trailing space to the filename. FileProcessorService inspects the raw name but the subsequent sanitizeFileName call removes the space, causing the file to be stored with an executable extension under public/cache/documents/. The web server executes the file, giving the attacker the capability to run arbitrary code on the server as the web‑server user.

The affected product is Thelia. Versions prior to 3.1.2 and all 3.2.x releases earlier than 3.2.1 are impacted. Updated releases 3.1.2 and 3.2.1 contain the fix.

The CVSS score of 8.6 classifies this flaw as High severity. An attacker must first have authenticated back‑office credentials to exploit the flaw, so the attack vector is a web‑based authenticated request. Operative exploitation requires a modern web server capable of executing PHP and not already hardening the cache directory. Because EPSS data is not available and the flaw is not listed in the CISA KEV catalog, the public exploit landscape is currently unquantified, but the high CVSS and potential for remote code execution make the risk significant.