Thelia
Monthly
Remote code execution in the Thelia e-commerce platform (all versions before 3.1.2 and 3.2.x before 3.2.1) allows an authenticated back-office user to upload a PHP payload that is written into the web-served public/cache/documents/ directory and executed as the web server user. The flaw exists because FileProcessorService validates the filename exactly as the client sent it, while FileManager::renameFile()/sanitizeFileName() later strips characters outside [a-zA-Z0-9-_.], so a name such as 'report.php ' survives validation but is stored as the executable 'report.php'. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires a valid administrative account with access to the document-upload feature; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.1.2 and 3.2.1.
Server-side template injection in the back-office Email/Messages feature of Thelia 3.0.0 lets an authenticated user holding the 'Messages' permission submit unsandboxed Twig templates that the application compiles and executes as raw PHP, enabling arbitrary function calls, sensitive file reads, and potential filesystem writes that can compromise both the application and its underlying host. Exploitation requires valid back-office credentials plus the 'Messages' privilege (CVSS vector PR:L), so there is no anonymous or mass-exploitation path; EPSS is low at 0.19% (8th percentile) and no public exploit code or CISA KEV entry has been identified, though the flaw is remotely triggerable and rated 8.8 for its high confidentiality, integrity, and availability impact once the privilege prerequisite is met. The vendor has shipped a fix in thelia/twig-engine-module 1.0.9.
Authenticated back-office users of Thelia through 2.6.1 can chain a path traversal flaw in the translation editor with a PHP string-escaping failure to write and execute arbitrary PHP code on the server, achieving remote code execution with web-server privileges. The attack requires a back-office account holding UPDATE-level permission on the admin.configuration.language resource (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, assessed 8.8), so it is not reachable by unauthenticated or low-privilege users despite the network attack vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.47% (39th percentile), making this a high-impact but moderate real-world priority.
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying server by uploading a PHP file through the store banner upload feature, which validates file type solely on the client-supplied MIME type rather than inspecting file content or extension. The flaw affects Thelia v2.6.0 and carries a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity, and availability on a successful upload-to-execution chain, though the PR:H vector means the attacker must already hold high privileges and no pre-authentication path is involved. No public exploit code has been identified at time of analysis, and exploitation additionally assumes the web server executes PHP from the directory where uploaded banners are stored.
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update endpoint to upload a server-executable file such as a PHP script. The document upload endpoint correctly blocks executable file types, but the update path omits the same validation (CWE-434), so the flaw is a validation gap between two sibling features rather than a broken upload filter overall. Exploitation is access-gated: the CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms network reachability but requires high-privilege Thelia admin credentials, and the server must actually execute PHP from the writable document location; impact is rated high for confidentiality, integrity, and availability, but no public exploit code or confirmed active exploitation was identified at time of analysis.
CSV formula injection in Thelia (before 3.1.2 and 3.2.0 through 3.2.0, fixed in 3.2.1) lets unauthenticated visitors plant spreadsheet formulas in registration, checkout, and newsletter fields that are later exported verbatim by CSVSerializer and executed when an administrator opens the file in Excel, LibreOffice Calc, or Google Sheets. The attacker never touches the Thelia server: impact is limited to the exporting administrator's workstation, and exploitation depends on an admin both performing the export and opening the resulting file (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 2.3). No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the low EPSS-style risk profile is consistent with the assessed vector - this is a genuinely low-priority issue that vendor patches already resolve.
Authenticated template injection in Thelia versions up to and including 2.6.1 lets a logged-in user with access to Smarty template-name handling point the engine at an arbitrary absolute filesystem path, which can result in server-side template injection and, in some deployments, remote code execution. The flaw is post-authentication (CVSS vector PR:L) and the RCE outcome is conditional: it depends on Smarty loading/compiling the referenced file without an effective security policy and on a suitable file existing at the referenced path, so impact is not guaranteed on every installation. No public exploit code and no active exploitation were identified at time of analysis (EPSS 0.40%, ~32nd percentile), and no vendor-released fixed version was confirmed from the provided references (CERT/CC advisory VU#162329; CVE-2026-103537).
Remote code execution in Thelia 2.6.0 and earlier is achievable by an authenticated back-office administrator who uses the module ZIP upload-and-install feature to deliver a crafted module whose install() method contains embedded PHP; that code is executed on installation with the privileges of the web server. The affected scope is Thelia up to and including 2.6.0, and exploitation requires the highest application privilege level (an administrator account), which is why the independent assessment rates real-world priority as LOW despite high confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is only 0.19% (8th percentile), so this is best treated as an insider/misconfiguration-adjacent hardening issue rather than an urgent internet-facing threat.
Authenticated administrators of Thelia 2.6.0 and earlier can achieve remote code execution by injecting malicious Smarty expressions into email templates, which execute with web process privileges when previewed or rendered. The vulnerability requires high-privilege back-office access, but successful exploitation enables arbitrary OS command execution and file read/write. No active exploitation has been confirmed and no public exploit code is currently identified.
Reflected cross-site scripting in Thelia versions up to 2.6.0 allows remote attackers to execute arbitrary JavaScript in the context of an authenticated user's session by crafting a link with a malicious 'next' parameter. The flaw arises from improper escaping of double quotes in the Smarty templates address.html and address-update.html, requiring the victim to click the link while logged in. No public exploit code or active exploitation has been identified at time of analysis; EPSS estimates a 0.16% probability of exploitation in the next 30 days, and the CVSS score is 6.1 (moderate).
Username enumeration in Thelia 2.6.0 lets unauthenticated remote attackers determine which administrator accounts exist by observing that the administrative login and forgotten-password endpoints respond differently to invalid usernames versus incorrect passwords. Because those endpoints apply no rate limiting or anti-automation controls, enumeration can be carried out efficiently at scale, with the resulting account list serving as reconnaissance for later credential attacks. The issue only discloses account existence (low confidentiality impact) and does not grant access; no public exploit code or confirmed active exploitation was identified at time of analysis, and the reported CVSS base score of 3.7 reflects the low severity.
Stored cross-site scripting in Thelia (all versions from 0 through 2.6.0) lets an authenticated back-office user - specifically one with permission to create categories or products - persist malicious JavaScript that is later executed when an administrator in the admin interface or a shopper on the storefront product pages views the poisoned content. Because the script fires in the victim's browser session, the attacker can read or manipulate whatever that session can access, but there is no direct server-side compromise and a second user must load the affected page for the payload to run. No public exploit identified at time of analysis, and the EPSS score is low at 0.17% (5th percentile), making this a low-to-moderate priority issue rather than a critical one.
An open redirect in Thelia's address-creation workflow (versions up to and including 2.6.0) lets an attacker craft a URL that carries an arbitrary external destination in the 'next' parameter; once the victim completes the 'Add New Address' form, the application redirects them to that attacker-controlled site. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N) but requires the victim to both open the crafted link and successfully submit the form (UI:R), and it produces no server-side compromise - impact is limited to confidentiality and integrity at low severity with changed scope. EPSS is only 0.18% (7th percentile), and no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in the Thelia e-commerce platform (all versions before 3.1.2 and 3.2.x before 3.2.1) allows an authenticated back-office user to upload a PHP payload that is written into the web-served public/cache/documents/ directory and executed as the web server user. The flaw exists because FileProcessorService validates the filename exactly as the client sent it, while FileManager::renameFile()/sanitizeFileName() later strips characters outside [a-zA-Z0-9-_.], so a name such as 'report.php ' survives validation but is stored as the executable 'report.php'. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires a valid administrative account with access to the document-upload feature; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.1.2 and 3.2.1.
Server-side template injection in the back-office Email/Messages feature of Thelia 3.0.0 lets an authenticated user holding the 'Messages' permission submit unsandboxed Twig templates that the application compiles and executes as raw PHP, enabling arbitrary function calls, sensitive file reads, and potential filesystem writes that can compromise both the application and its underlying host. Exploitation requires valid back-office credentials plus the 'Messages' privilege (CVSS vector PR:L), so there is no anonymous or mass-exploitation path; EPSS is low at 0.19% (8th percentile) and no public exploit code or CISA KEV entry has been identified, though the flaw is remotely triggerable and rated 8.8 for its high confidentiality, integrity, and availability impact once the privilege prerequisite is met. The vendor has shipped a fix in thelia/twig-engine-module 1.0.9.
Authenticated back-office users of Thelia through 2.6.1 can chain a path traversal flaw in the translation editor with a PHP string-escaping failure to write and execute arbitrary PHP code on the server, achieving remote code execution with web-server privileges. The attack requires a back-office account holding UPDATE-level permission on the admin.configuration.language resource (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, assessed 8.8), so it is not reachable by unauthenticated or low-privilege users despite the network attack vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.47% (39th percentile), making this a high-impact but moderate real-world priority.
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying server by uploading a PHP file through the store banner upload feature, which validates file type solely on the client-supplied MIME type rather than inspecting file content or extension. The flaw affects Thelia v2.6.0 and carries a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity, and availability on a successful upload-to-execution chain, though the PR:H vector means the attacker must already hold high privileges and no pre-authentication path is involved. No public exploit code has been identified at time of analysis, and exploitation additionally assumes the web server executes PHP from the directory where uploaded banners are stored.
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update endpoint to upload a server-executable file such as a PHP script. The document upload endpoint correctly blocks executable file types, but the update path omits the same validation (CWE-434), so the flaw is a validation gap between two sibling features rather than a broken upload filter overall. Exploitation is access-gated: the CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms network reachability but requires high-privilege Thelia admin credentials, and the server must actually execute PHP from the writable document location; impact is rated high for confidentiality, integrity, and availability, but no public exploit code or confirmed active exploitation was identified at time of analysis.
CSV formula injection in Thelia (before 3.1.2 and 3.2.0 through 3.2.0, fixed in 3.2.1) lets unauthenticated visitors plant spreadsheet formulas in registration, checkout, and newsletter fields that are later exported verbatim by CSVSerializer and executed when an administrator opens the file in Excel, LibreOffice Calc, or Google Sheets. The attacker never touches the Thelia server: impact is limited to the exporting administrator's workstation, and exploitation depends on an admin both performing the export and opening the resulting file (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 2.3). No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the low EPSS-style risk profile is consistent with the assessed vector - this is a genuinely low-priority issue that vendor patches already resolve.
Authenticated template injection in Thelia versions up to and including 2.6.1 lets a logged-in user with access to Smarty template-name handling point the engine at an arbitrary absolute filesystem path, which can result in server-side template injection and, in some deployments, remote code execution. The flaw is post-authentication (CVSS vector PR:L) and the RCE outcome is conditional: it depends on Smarty loading/compiling the referenced file without an effective security policy and on a suitable file existing at the referenced path, so impact is not guaranteed on every installation. No public exploit code and no active exploitation were identified at time of analysis (EPSS 0.40%, ~32nd percentile), and no vendor-released fixed version was confirmed from the provided references (CERT/CC advisory VU#162329; CVE-2026-103537).
Remote code execution in Thelia 2.6.0 and earlier is achievable by an authenticated back-office administrator who uses the module ZIP upload-and-install feature to deliver a crafted module whose install() method contains embedded PHP; that code is executed on installation with the privileges of the web server. The affected scope is Thelia up to and including 2.6.0, and exploitation requires the highest application privilege level (an administrator account), which is why the independent assessment rates real-world priority as LOW despite high confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is only 0.19% (8th percentile), so this is best treated as an insider/misconfiguration-adjacent hardening issue rather than an urgent internet-facing threat.
Authenticated administrators of Thelia 2.6.0 and earlier can achieve remote code execution by injecting malicious Smarty expressions into email templates, which execute with web process privileges when previewed or rendered. The vulnerability requires high-privilege back-office access, but successful exploitation enables arbitrary OS command execution and file read/write. No active exploitation has been confirmed and no public exploit code is currently identified.
Reflected cross-site scripting in Thelia versions up to 2.6.0 allows remote attackers to execute arbitrary JavaScript in the context of an authenticated user's session by crafting a link with a malicious 'next' parameter. The flaw arises from improper escaping of double quotes in the Smarty templates address.html and address-update.html, requiring the victim to click the link while logged in. No public exploit code or active exploitation has been identified at time of analysis; EPSS estimates a 0.16% probability of exploitation in the next 30 days, and the CVSS score is 6.1 (moderate).
Username enumeration in Thelia 2.6.0 lets unauthenticated remote attackers determine which administrator accounts exist by observing that the administrative login and forgotten-password endpoints respond differently to invalid usernames versus incorrect passwords. Because those endpoints apply no rate limiting or anti-automation controls, enumeration can be carried out efficiently at scale, with the resulting account list serving as reconnaissance for later credential attacks. The issue only discloses account existence (low confidentiality impact) and does not grant access; no public exploit code or confirmed active exploitation was identified at time of analysis, and the reported CVSS base score of 3.7 reflects the low severity.
Stored cross-site scripting in Thelia (all versions from 0 through 2.6.0) lets an authenticated back-office user - specifically one with permission to create categories or products - persist malicious JavaScript that is later executed when an administrator in the admin interface or a shopper on the storefront product pages views the poisoned content. Because the script fires in the victim's browser session, the attacker can read or manipulate whatever that session can access, but there is no direct server-side compromise and a second user must load the affected page for the payload to run. No public exploit identified at time of analysis, and the EPSS score is low at 0.17% (5th percentile), making this a low-to-moderate priority issue rather than a critical one.
An open redirect in Thelia's address-creation workflow (versions up to and including 2.6.0) lets an attacker craft a URL that carries an arbitrary external destination in the 'next' parameter; once the victim completes the 'Add New Address' form, the application redirects them to that attacker-controlled site. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N) but requires the victim to both open the crafted link and successfully submit the form (UI:R), and it produces no server-side compromise - impact is limited to confidentiality and integrity at low severity with changed scope. EPSS is only 0.18% (7th percentile), and no public exploit code or active exploitation has been identified at time of analysis.