HIGH 8.6 NVD
CVE-2026-109397
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.
References
- https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/File/Service/FileProcesso
- https://github.com/thelia/thelia/commit/6b706f5cb96e6b12d890c6d16edb1c9d1fd8191a
- https://github.com/thelia/thelia/commit/b71258902b5dd278007d0f37ddad45f76d06d5bc
- https://github.com/thelia/thelia/releases/tag/3.1.2
- https://github.com/thelia/thelia/releases/tag/3.2.1
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-10-12 via NVD.
vulnfeed aggregates 10929 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.