CVE-2026-103535

Deferred Deferred - Pending Action

Path Traversal and PHP Code Injection in Thelia Translation Editor

Publication date: 2026-10-12

Last updated on: 2026-10-15

Assigner: CERT/CC

Description

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-12

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103535

EUVD

EUVD-2026-97482

Affected Vendors & Products

Vendor	Product	Version / Range
Thelia	Thelia	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

Thelia v2.6.1 has two vulnerabilities that can be combined to execute remote code. First, path traversal allows writing files outside the intended directory via unsanitized input in the item_name parameter. Second, PHP code injection occurs because backslashes in user input are not escaped, enabling code to break out of PHP strings. Together, these flaws let an attacker write and execute a malicious PHP file on the server.

Detection Guidance

Check for unauthorized PHP files in web-accessible directories, especially outside the templates/ folder. Inspect translation files for suspicious code injection or path traversal sequences like ../ in the item_name parameter. Review server logs for unusual file write operations or PHP execution attempts.

Impact Analysis

An authenticated user with UPDATE permissions on admin.configuration.language could exploit this to upload and execute arbitrary PHP code on the server. This could lead to full system compromise, data theft, or further network infiltration depending on the server's configuration and privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. A successful exploit may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for affected organizations.

Mitigation Strategies

Upgrade Thelia to a patched version if available. Restrict UPDATE permissions on admin.configuration.language to trusted users only. Disable write access to web-accessible directories except for required applications. Monitor file system changes and disable PHP execution in directories where it is not needed.

Hi! I’m here to help you understand CVE-2026-103535. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70