Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109397Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

High 7.2

In plain English

A high-severity unrestricted file upload in Thelia from Thelia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.4%top 61.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

Affected products (as reported)

Vendor	Product	Versions
Thelia	Thelia	0 – before 3.1.23.2.0 – before 3.2.1

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-5524-qfxp-33v9) vendor-advisory
https://github.com/thelia/thelia/commit/6b706f5cb96e6b12d890c6d16edb1c9d1fd8191a patch
https://github.com/thelia/thelia/commit/b71258902b5dd278007d0f37ddad45f76d06d5bc patch
https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/File/Service/FileProcessorService.php#L119-L160 technical-description
Thelia 3.1.2 Release Notes release-notes
Thelia 3.2.1 Release Notes release-notes
VulnCheck Advisory: Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space third-party-advisory