CVE-2026-103535
Received Received - Intake

Path Traversal and PHP Code Injection in Thelia Translation Editor

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: CERT/CC

Description
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-103535
EUVD
EUVD-2026-97482

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thelia Thelia 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Thelia v2.6.1 has two vulnerabilities that can be combined to execute remote code. First, path traversal allows writing files outside the intended directory via unsanitized input in the item_name parameter. Second, PHP code injection occurs because backslashes in user input are not escaped, enabling code to break out of PHP strings. Together, these flaws let an attacker write and execute a malicious PHP file on the server.

Detection Guidance

Check for unauthorized PHP files in web-accessible directories, especially outside the templates/ folder. Inspect translation files for suspicious code injection or path traversal sequences like ../ in the item_name parameter. Review server logs for unusual file write operations or PHP execution attempts.

Impact Analysis

An authenticated user with UPDATE permissions on admin.configuration.language could exploit this to upload and execute arbitrary PHP code on the server. This could lead to full system compromise, data theft, or further network infiltration depending on the server's configuration and privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. A successful exploit may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for affected organizations.

Mitigation Strategies

Upgrade Thelia to a patched version if available. Restrict UPDATE permissions on admin.configuration.language to trusted users only. Disable write access to web-accessible directories except for required applications. Monitor file system changes and disable PHP execution in directories where it is not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103535. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart