Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply…

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution

Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting…

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface

Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated…