CVE-2026-103521
Received Received - Intake

Arbitrary File Upload Leading to Remote Code Execution in Thelia

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: CERT/CC

Description
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-103521
EUVD
EUVD-2026-97474

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thelia Thelia 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-103521 is a vulnerability in Thelia v2.6.0 where the document update endpoint lacks validation for executable file types, unlike the document upload endpoint. An attacker with admin permissions can exploit this to upload malicious files like PHP scripts and achieve remote code execution on the server.

Detection Guidance

Check Thelia admin logs for suspicious document update actions or unexpected file uploads. Inspect uploaded files in the document directory for executable extensions like .php, .exe, or .sh. Use file integrity monitoring tools to detect unauthorized changes in web directories.

Impact Analysis

If you use Thelia v2.6.0 or v2.6.1, an attacker with admin access could upload and execute malicious files on your server. This could lead to unauthorized system access, data theft, or further compromise of your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest Thelia security patches immediately. Disable document update functionality if not required. Restrict administrative access to trusted users only. Implement strict file upload validation to block executable file types.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103521. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart