Thelia CVE-2026-103535

Requires an authenticated back-office user holding UPDATE-level permission on the admin.configuration.language resource, operating the Thelia translation editor. The attacker supplies a malicious item_name parameter: the first flaw is that item_name is used unsanitized to build the translation file write path, so ../ sequences escape the intended templates/ directory into web-accessible locations; the second flaw is that the translation-writing logic fails to escape the backslash (\) character in user-supplied values, allowing a breakout from the PHP string literal to inject executable code. Both must be chained to plant and then execute a PHP file. Limiting factors: exploitation is gated by the specific language-configuration privilege (not available to low-privilege or unauthenticated users), and affects Thelia versions through 2.6.1; it is not a default-anonymous-access vulnerability despite the network attack vector.

This is a genuinely high-impact vulnerability but a moderate real-world priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) is internally consistent with the description: network-reachable admin endpoint, low complexity, and full confidentiality/integrity/availability loss via code execution. However, PR:L is a meaningful limiter - exploitation is NOT unauthenticated; it requires an authenticated back-office account holding UPDATE-level permission on admin.configuration.language, which is a privileged role rarely granted broadly. The EPSS score is low (0.47%, 39th percentile), it is NOT listed in CISA KEV, and no public exploit was identified in the provided data, so there is no evidence of active or widespread exploitation. The signals are therefore consistent rather than conflicting: high technical impact, but gated behind authentication and against a relatively niche product, which lowers mass-exploitation likelihood. The main conflict to flag is that the CVSS marks Scope Unchanged (S:U) even though the attacker crosses from the application's translation feature into arbitrary code execution as the web-server user and can write to web-accessible paths - an argument could be made for S:C; verify scope reasoning against the vendor/CERT/CC analysis.

An attacker who has compromised or been granted a back-office account with UPDATE rights on language configuration opens the translation editor and submits a crafted item_name containing ../ traversal sequences plus a backslash payload that breaks out of the PHP string literal, writing a malicious PHP file into a web-accessible directory. The attacker then requests that file directly over HTTP, achieving remote code execution with the web server's privileges. No public exploit code was identified at time of analysis, and the attack requires authenticated access, but low attack complexity makes it straightforward for an insider or anyone who obtains valid configuration-manager credentials.