Medium severity · published Oct 12, 2026
CVE-2026-103529
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TH
Thelia · Thelia
through 2.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103529
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103529
kb.cert.org
https://kb.cert.org/vuls/id/162329
More from Thelia
8.8
CVE-2026-107248
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply…
8.8
CVE-2026-103535
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution
7.2
CVE-2026-109397
Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
7.2
CVE-2026-103522
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types
7.2
CVE-2026-103521
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation