CVE-2026-103537
Thelia 2.6.1 absolute path traversal in Smarty template handling. The checkTemplate() validation blocks relative traversal like ../ but does not reject absolute paths.
@yogsec.bsky.social
@yogsec.bsky.socialCVE-2026-103537
Thelia 2.6.1 absolute path traversal in Smarty template handling. The checkTemplate() validation blocks relative traversal like ../ but does not reject absolute paths.
@stackflag.bsky.socialCVE-2026-109397 - thelia
In Thelia versions earlier than 3.1.2 and 3.2.1, a back‑office user can add a space to the end of a file name and upload a PHP file that the system saves as an executable script. This lets the…
Too many irrelevant or confusing CVEs? Use stackflag.com
@securityonline.bsky.socialCERT/CC lists 11 unpatched Thelia vulnerabilities, including remote code execution flaws in versions 2.6.0, 2.6.1 and 3.0.0. Lock down admin access now.
#Thelia #RemoteCodeExecution #CVE2026103528 #CVE2026103529 #CVE2026103521 #Ecommerce #CERTCC #CyberSecurity