Unrestricted File Upload in Thelia CMS

Executive Summary

CVE-2026-109397 is an unrestricted file upload vulnerability in Thelia versions before 3.1.2 and 3.2.x before 3.2.1. It allows authenticated back-office users to upload PHP files by adding a trailing space to filenames. The system validates the raw filename but strips the space during storage, saving an executable .php file in a public directory where the web server can execute it.

Useful 0 Not Useful 0

Detection Guidance

Check Thelia versions with: grep -r 'version' /path/to/thelia/composer.json. Inspect public/cache/documents/ for unexpected PHP files with trailing spaces or unusual names. Review FileProcessorService.php for missing validation of sanitized filenames. Use: find public/cache/documents/ -name '*.php ' -o -name '*.php ' to detect files with trailing spaces.

Useful 0 Not Useful 0

Impact Analysis

An attacker with document upload privileges can execute arbitrary commands on the server, read sensitive data like database credentials, modify files, and potentially take over the host system. The vulnerability requires only basic administrative access and no user interaction, making it highly dangerous.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, unauthorized modifications, and loss of compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Thelia to version 3.1.2 or 3.2.1 immediately. Remove any unauthorized PHP files from public/cache/documents/. Restrict document upload permissions to least privilege. Serve document caches from non-executable directories. Monitor for suspicious file uploads or web server activity.

Useful 0 Not Useful 0