Read the docs
TI-2026-71005 Aliases CVE-2026-103535GHSA-qv6x-p59r-f4h3

Thelia translation editor flaws allow remote code execution

Priority MEDIUM 42CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.

Summary

Thelia versions through 2.6.1 contain path traversal and PHP code injection flaws in the translation editor that can be chained to achieve remote code execution. The item_name parameter, used to build the translation file write path, does not sanitize directory traversal sequences, and the translation writer does not escape backslashes in user supplied values (CWE-94). An authenticated user with UPDATE permission on admin.configuration.language can write a malicious PHP file to a web-accessible path and run it with the web server's privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01051 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TheliaTheliaup to 2.6.1—No fix listedCNA
  • Thelia VendorThelia Affected up to 2.6.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Thelia.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-103535
  2. 2026-10-12 Alias added: GHSA-qv6x-p59r-f4h3
  3. 2026-10-16 EPSS moved to the 50th–90th percentile
  4. 2026-10-16 CVSS score added · CISA ADP
  5. 2026-10-16 Weakness changed · CISA ADP
  6. 2026-10-16 CISA SSVC decision points changed
  7. 2026-10-16 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2026-83555 Stored cross-site scripting in Thelia via coupon customer names CVSS 4.0HIGH 7.4
  • TI-2026-83574 Cross-site request forgery in Thelia back-office product combination routes CVSS 4.0MEDIUM 6.9
  • TI-2026-83557 CSRF in Thelia Page Module delete routes lets attackers remove images CVSS 4.0HIGH 7.0
  • TI-2026-83556 Thelia back office CSRF via leaked URL tokens and unprotected actions CVSS 4.0MEDIUM 5.9
  • TI-2026-71031 CSV formula injection in Thelia exports lets visitors run spreadsheet formulas CVSS 4.0LOW 2.3
  • TI-2026-71032 Unrestricted file upload in Thelia allows PHP code execution CVSS 4.0HIGH 8.6
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences