Thelia CVE-2026-103522

Exploitation requires an authenticated Thelia administrator account (CVSS PR:H) with access to the store banner upload feature; the attacker uploads a PHP file carrying a forged image MIME type, exploiting the fact that filetype validation relies exclusively on client-supplied MIME rather than content inspection. Limiting factors: the attacker must already possess admin privileges, so this is not a pre-authentication vector; exploitation also assumes the uploaded banner is stored in a location from which PHP can be executed by the web server. Confirmed affected: Thelia v2.6.0.

This is a high-CVSS (7.2) but materially constrained flaw. The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N shows network reach and low attack complexity, but critically requires PR:H - the description confirms the attacker must already hold administrative access to the Thelia back office. This makes it a post-authentication privilege-to-RCE escalation rather than a remotely exploitable entry point. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no signal of active or widespread exploitation. The high confidentiality/integrity/availability impact (C:H/I:H/A:H) reflects full server compromise via arbitrary PHP execution, which is credible given CWE-434 and PHP-based deployment. Net: a genuine RCE for an attacker who already controls the admin panel, but the PR:H gate and absence of exploitation signals place it well below internet-facing unauthenticated flaws in triage priority. Note a minor tension to verify with the vendor: the AV:N rating assumes the admin upload interface is network-reachable, which is typical for a web store admin but should be confirmed against the actual deployment exposure.

An attacker who has obtained Thelia administrator credentials (via phishing, credential reuse, or an insider) navigates to the store banner upload feature and submits a PHP webshell renamed with an image extension and a spoofed image/* MIME type. Because validation trusts the client-supplied MIME type, the file is stored in a web-accessible path and the attacker requests it to execute arbitrary code as the web server user. No public exploit code is identified at time of analysis, though the technique is a well-understood file-upload bypass.