EUVD-2026-97481
GHSA-9w4q-cg82-c2wf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Thelia admin credentials
-
ExploitCraft malicious module ZIP with PHP in install()
-
ExecutionUpload and install via admin module manager
-
ImpactExecute arbitrary code as web server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Thelia back-office administrator account with access to the module management / ZIP upload-and-install feature; exploitation occurs because module code - specifically the install() method - is executed on installation without validation or sandboxing of embedded PHP. Limiting factors: this is the highest application privilege level (administrator), so the attacker must already be trusted or have compromised admin credentials; no end-user interaction is needed beyond the attacker's own install action, and no special non-default configuration is required since module installation is a core admin feature. Affected: Thelia versions up to and including 2.6.0. |
| Impact | Signals are consistent and point to a LOW real-world priority. The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) requires authenticated access (PR:L), and in practice the only account able to reach the module ZUP upload/install feature is a Thelia back-office administrator - the highest privilege tier in the application - so this is a post-authentication issue abusable only by an already-trusted operator. Note a conflict worth flagging: the description claims full remote code execution 'with the privileges of the web server,' which normally warrants C:H/I:H/A:H, yet the provided vector reports only C:L/I:L/A:N - the published base score appears to understate technical impact, likely because the rater discounted it as admin-only functionality; verify impact scoring with CERT/CC. EPSS is very low (0.19%, 8th percentile), there is NO CISA KEV listing, and no public exploit was identified, so exploitation status is 'no public exploit identified at time of analysis.' All signals align: genuine RCE capability but gated behind administrator trust, making this a high-privilege-required, low-urgency finding rather than a mass-exploitation threat. |
| Exploit ScenarioDerived | An attacker who has already obtained Thelia back-office administrator credentials (via phishing, credential reuse, or an insider) crafts a malicious module ZIP whose install() method contains PHP code such as a web shell, then uploads and installs it through the admin module manager. On installation the embedded PHP executes with the privileges of the web server, yielding remote code execution. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Remote code execution in Thelia 2.6.0 and earlier is achievable by an authenticated back-office administrator who uses the module ZIP upload-and-install feature to deliver a crafted module whose install() method contains embedded PHP; that code is executed on installation with the privileges of the web server. The affected scope is Thelia up to and including 2.6.0, and exploitation requires the highest application privilege level (an administrator account), which is why the independent assessment rates real-world priority as LOW despite high confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is only 0.19% (8th percentile), so this is best treated as an insider/misconfiguration-adjacent hardening issue rather than an urgent internet-facing threat.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must start with compensating controls. First, restrict or disable the module ZIP upload-and-install capability entirely on production instances (remove or ACL-gate the module management controller), accepting the operational trade-off that legitimate third-party module updates must be performed out-of-band by a trusted operator; if the feature must stay enabled, allowlist administrative access to it by source IP and enforce MFA plus strong credential hygiene on all administrator accounts, since the sole prerequisite is an authenticated admin session. Second, harden the execution environment: run the web server under a least-privilege OS account with no write access outside the application tree, disable dangerous PHP functions (exec, system, passthru, shell_exec, popen, eval) via php.ini disable_functions, and constrain outbound network egress - each of these reduces post-exploitation reach but may break legitimate modules that rely on subprocess or network calls. Third, add detection and containment: enforce filesystem integrity monitoring on the modules/ and web-root directories, alert on new or modified PHP files after any install action, and deploy WAF rules that inspect multipart ZIP uploads and PHP content within archives, understanding that signature-based filtering is bypassable. Monitor the CERT/CC note (https://kb.cert.org/vuls/id/162329) and the NVD/EUVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-103529) for a vendor fix, and apply the official patched release as soon as it is published rather than relying indefinitely on the controls above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Thelia is a PHP e-commerce and CMS platform that supports extensibility through downloadable/uploadable modules packaged as ZIP archives. CWE-434 (Unrestricted Upload of File with Dangerous Type) is the root cause here: the platform accepts an arbitrary ZIP archive through the administrative module management interface and, during installation, deserializes/loads the module and invokes its PHP install() method without validating or sandboxing the embedded PHP. Because a PHP module is simply a set of scripts executed in-process by the web server's PHP interpreter, any code placed in install() runs with the effective UID of the web server, granting the attacker arbitrary command execution, file-system access, and lateral movement potential within the hosting environment. The CPE cpe:2.3:a:thelia:thelia:*:*:*:*:*:*:*:* and the EUVD range 'Thelia 0 ≤ 2.6.0' both confirm all releases through 2.6.0 are in scope. The disclosure's CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) reflects only limited impact, but the independent assessment revises this to PR:H with C:H/I:H/A:H, recognizing that module install is an inherently code-executing administrative operation and that the practical barrier is obtaining an administrator session rather than any technical constraint.
Know when Thelia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Only a trusted back-office administrator can reach module installation, so PR:H; network-reachable admin UI (AV:N) with no mitigating complexity (AC:L); arbitrary PHP execution yields full C/I/A:H.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
2DescriptionCVE.org
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install() method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Authenticated back-office users of Thelia through 2.6.1 can chain a path traversal flaw in the translation editor with a
Server-side template injection in the back-office Email/Messages feature of Thelia 3.0.0 lets an authenticated user hold
Remote code execution in the Thelia e-commerce platform (all versions before 3.1.2 and 3.2.x before 3.2.1) allows an aut
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update en
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying serve
An open redirect in Thelia's address-creation workflow (versions up to and including 2.6.0) lets an attacker craft a URL
Reflected cross-site scripting in Thelia versions up to 2.6.0 allows remote attackers to execute arbitrary JavaScript in
Authenticated administrators of Thelia 2.6.0 and earlier can achieve remote code execution by injecting malicious Smarty
Authenticated template injection in Thelia versions up to and including 2.6.1 lets a logged-in user with access to Smart
Stored cross-site scripting in Thelia (all versions from 0 through 2.6.0) lets an authenticated back-office user - speci
Username enumeration in Thelia 2.6.0 lets unauthenticated remote attackers determine which administrator accounts exist
CSV formula injection in Thelia (before 3.1.2 and 3.2.0 through 3.2.0, fixed in 3.2.1) lets unauthenticated visitors pla
Exploit-DB