Thelia CVE-2026-103521

Exploitation requires an authenticated account with administrative Thelia permissions (CVSS PR:H) and specifically abuses the document UPDATE endpoint in Thelia v2.6.0, which - unlike the document UPLOAD endpoint - fails to validate/block executable file types (CWE-434). The attacker must be able to reach the admin interface over the network (AV:N) and upload a server-executable file such as a PHP script, then invoke it via the web server to gain RCE. Limiting factors: this is not reachable by anonymous/unauthenticated users; it depends on the attacker first holding admin-level access, and on the server being configured to execute uploaded PHP files from the writable document location. No end-user interaction is required (UI:N).

This is a genuine but access-gated risk. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) shows a network-reachable, low-complexity flaw with full confidentiality, integrity, and availability impact - consistent with remote code execution. The critical limiter is PR:H: exploitation requires an authenticated account with administrative Thelia permissions, which substantially narrows the realistic attacker population to insiders, compromised admin credentials, or chained attacks. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so the correct exploitation status is 'no public exploit identified at time of analysis'; there is no evidence of active or widespread exploitation. There is no SSVC decision data in the input to cross-reference. The signals are internally consistent (the description's 'administrative permissions' matches PR:H; the RCE outcome matches C:H/I:H/A:H), so no contradiction needs flagging - the main caveat is that this is an admin-authenticated weakness, which makes it a post-authentication RCE / privilege-abuse issue rather than a wormable internet-facing threat. Treat it as a meaningful-but-not-emergency priority: patch promptly, but it is not a high-urgency mass-exploitation candidate absent POC or KEV evidence.

An attacker who already holds administrative Thelia credentials (via compromise, insider access, or a chained privilege escalation) uses the document update endpoint - which skips the executable-type validation enforced on the upload endpoint - to replace or update a document with a malicious PHP script. They then request that script through the web server to execute arbitrary code on the host. No public exploit code was identified in the provided data.