Read the docs
TI-2026-71032 Aliases CVE-2026-109397GHSA-hjxm-gpw4-w4q7

Unrestricted file upload in Thelia allows PHP code execution

Priority MEDIUM 40CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload flaw (CWE-434). The application validates the raw filename but then strips trailing spaces during sanitization, so an authenticated back-office user can upload a PHP file that is stored as an executable script. The attacker needs high privileges to log in to the back office, and successful exploitation allows code execution as the web server user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix Fixed Thelia (Thelia): 3.1.2, 3.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TheliaTheliabefore 3.1.2; 3.2.0 to before 3.2.13.1.2, 3.2.1Patch availableCNA
  • Thelia VendorThelia Affected before 3.1.2; 3.2.0 to before 3.2.1 Fixed in 3.1.2, 3.2.1 Patch available CNA

Remediation

Upgrade Thelia to version 3.1.2 or 3.2.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Thelia (Thelia) Fixed in 3.1.2, 3.2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Thelia 3.1.2, 3.2.1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-71031 CSV formula injection in Thelia exports lets visitors run spreadsheet formulasPriority MEDIUM 45
    Show all 2 records →

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109397
  2. 2026-10-12 Alias added: GHSA-hjxm-gpw4-w4q7
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-13 CISA SSVC decision points changed
  5. 2026-10-13 Priority changed: LOW → MEDIUM

References

Patch 2

Advisory 1

Other 3

  • TI-2026-83555 Stored cross-site scripting in Thelia via coupon customer names CVSS 4.0HIGH 7.4
  • TI-2026-83574 Cross-site request forgery in Thelia back-office product combination routes CVSS 4.0MEDIUM 6.9
  • TI-2026-83557 CSRF in Thelia Page Module delete routes lets attackers remove images CVSS 4.0HIGH 7.0
  • TI-2026-83556 Thelia back office CSRF via leaked URL tokens and unprotected actions CVSS 4.0MEDIUM 5.9
  • TI-2026-71031 CSV formula injection in Thelia exports lets visitors run spreadsheet formulas CVSS 4.0LOW 2.3
  • TI-2026-71005 Thelia translation editor flaws allow remote code execution CVSS 3.1HIGH 8.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences