TH
Product
Thelia
14
CVEs
0
On KEV
8.8
Max CVSS
14
New 30D
Severity mix
Critical 0High 5Medium 8Low 1
Watch
Add Thelia to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107248 | 8.8 | Oct 12 | Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply… Affected: 3.0.0 |
| CVE-2026-103535 | 8.8 | Oct 12 | Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution Affected: through 2.6.1 |
| CVE-2026-109397 | 7.2 | Oct 12 | Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space Affected: before 3.1.2; 3.2.0 before 3.2.1 |
| CVE-2026-103522 | 7.2 | Oct 12 | In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types Affected: through 2.6.0 |
| CVE-2026-103521 | 7.2 | Oct 12 | In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation Affected: through 2.6.0 |
Showing 5