Skip to main content

Thelia 2.6.0 and 2.6.1 flaws could enable remote code execution

Source Decision Insights Threat Desk Published October 12, 2026
Human View Machine View

Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities across file management, Smarty templating, module installation, and administrative workflows. Thelia is an open-source e-commerce platform for merchants. Exploitation could enable remote code execution, server-side template injection, cross-site scripting, and unauthorized URL redirection.

CVE-2026-103521 affects v2.6.0, where the document update endpoint skips the executable type checks applied by the upload endpoint, letting an administrator with Thelia permissions upload executables such as PHP scripts. CVE-2026-103522 affects v2.6.0's store banner upload, which relies solely on client-supplied MIME types, so a PHP file disguised as an image passes. CVE-2026-103524 is multiple stored XSS in v2.6.0's admin interface, where input lacks output encoding or sanitization before rendering in admin and product pages, including category and product creation.

CVE-2026-103523 is an open redirect in v2.6.0's address creation workflow, where the next parameter sends users, after a crafted URL is visited and Add New Address is submitted, to an external URL without same-origin or allowlist checks. CVE-2026-103526 lets unauthenticated attackers enumerate administrator accounts, since login and forgotten password responses differ for invalid usernames and incorrect passwords, with no rate limiting. CVE-2026-103527 is reflected XSS in address.html and address-update.html, which fail to escape double quotes in the next parameter when an authenticated user visits a malicious link with attacker-controlled JavaScript.

CVE-2026-103528 affects Smarty email templates in v2.6.0, which lack restrictions on dangerous PHP functions. An authenticated administrator can inject Smarty expressions through the messages configuration interface, where system(), exec(), file_put_contents(), and file_get_contents() can run with web process privileges when the template is previewed or rendered. CVE-2026-103529 affects v2.6.0 ZIP module uploads, which install modules without validating or sandboxing embedded PHP, so code in the install() method executes upon installation. CVE-2026-103535 affects v2.6.1 translation editor path traversal via the item_name parameter, where ../ sequences are not sanitized, allowing an authenticated user with UPDATE-level permission on admin.configuration.language to write files outside templates/, including web-accessible directories. Separately, unescaped backslashes allow injected PHP code in translation files, and the two flaws can be chained. CVE-2026-103537 affects v2.6.1 checkTemplate() validation, which blocks ../ but not absolute paths, letting an authorized user supply an arbitrary filesystem path as a template. CVE-2026-107248 also appears in the advisory's CVE identifier list without a separate description.

Several of these issues allow authenticated administrative users to execute arbitrary code on the host server with web server privileges, including CVE-2026-103521, CVE-2026-103522, CVE-2026-103528, CVE-2026-103529, CVE-2026-103535, and CVE-2026-103537. CVE-2026-103524 and CVE-2026-103527 enable stored and reflected JavaScript execution in the browser, allowing administrative sessions to be hijacked. CVE-2026-103526 eases enumeration of administrator usernames, and CVE-2026-103523 enables redirection to external websites for phishing or other downstream attacks. Together, these issues facilitate full server takeover by authenticated administrative attackers and expose browser-based and credential attacks to authenticated and unauthenticated attackers.

Coordination with Thelia on these vulnerabilities was not achieved, and no patch is currently available. Until the issues are remediated, the advisory recommends restricting access to Thelia administrative interfaces, disabling or tightly limiting file-upload and template-editing features, and removing PHP execution permissions from user-writable directories where possible. Strict reverse-proxy controls such as rate limiting, MIME filtering, and URL allowlisting can further reduce exposure.

Blog post, originally published at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/thelia-2.6.0-and-2.6.1-flaws-could-enable-remote-code-execution/",
        "name": "Thelia 2.6.0 and 2.6.1 flaws could enable remote code execution",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/thelia-2.6.0-and-2.6.1-flaws-could-enable-remote-code-execution/#blogposting",
    "@type": "BlogPosting",
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-10-12T13:30:39-06:00",
    "datePublished": "2026-10-12T13:30:32-06:00",
    "description": "Thelia 2.6.0 and 2.6.1 contain vulnerabilities spanning file uploads, Smarty templating, and module installation, which could enable remote code execution.",
    "headline": "Thelia 2.6.0 and 2.6.1 flaws could enable remote code execution",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/162329"
    },
    "keywords": [
      "Server",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/thelia-2.6.0-and-2.6.1-flaws-could-enable-remote-code-execution/",
      "@type": "WebPage",
      "sdDatePublished": "2026-10-12",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/projects/php/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/php/",
        "name": "PHP"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages