Thelia CVE-2026-109397

Requires a valid authenticated back-office (administrative) account with access to the document/file upload feature (e.g., product documents), reflected as PR:H. The concrete prerequisite is the filename-sanitization mismatch: FileProcessorService validates the raw client filename while FileManager::renameFile()/sanitizeFileName() strips characters outside [a-zA-Z0-9-_.] (trailing space, tab, zero-width space, or in-extension whitespace), so a name like 'report.php ' passes validation but is stored as an executable 'report.php' under public/cache/documents/, which is web-served and allowed to execute PHP. Limiting factors: exploitation is impossible without back-office credentials, requires the document-upload capability, and affects only Thelia versions before 3.1.2 and 3.2.x before 3.2.1 - patched installations reject names that would be stored under a server-executable extension.

This is a credible but access-gated remote code execution flaw (CWE-434, unrestricted file upload) in the Thelia e-commerce platform. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6 (High) and is internally consistent with the description: exploitation is network-reachable with low complexity and no user interaction, but requires PR:H - an authenticated back-office (administrative) account - which is the single largest limiting factor. The high VC/VI/VA impact is justified because a stored .php file executing as the web server user yields full compromise of the application context. No EPSS score and no KEV listing were provided, and no public exploit is referenced, so exploitation signals are weak despite the high base score; the primary intelligence is the vendor security advisory (GHSA-5524-qfxp-33v9) and two confirmed patch commits reported by VulnCheck. Because the flaw requires privileged authentication, this is a 'high-CVSS but access-constrained' issue rather than an internet-wide mass-exploitation priority - it matters most where back-office access is broadly granted or where staff/credential compromise is plausible. Note the 'Microsoft' tag appears to be mislabeled (Thelia is an independent PHP/Symfony open-source project), which should not influence risk weighting.

An authenticated back-office user (or an attacker who has phished/compromised such a staff account) uploads a PHP payload named like 'report.php ' with a trailing space; FileProcessorService validates the raw name while FileManager::sanitizeFileName()/renameFile() strips the space and stores an executable 'report.php' under public/cache/documents/. The attacker then requests that URL to run arbitrary code as the web server user. No public proof-of-concept is referenced, but the patch diff and test cases fully disclose the bypass technique (trailing space, tab, zero-width space, double-extension variants).