Vulnerability · Published Oct 12, 2026 · Assigned by certcc
CVE-2026-103521CVE-2026-103521
High 7.2
In plain English
A high-severity unrestricted file upload in Thelia from Thelia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H