Overview
A high-severity remote code execution vulnerability has been disclosed in Thelia, the open-source e-commerce platform, affecting version 2.6.0 and earlier. Tracked as CVE-2026-103522, the flaw lives in the store banner upload feature, which validates uploaded files solely by trusting the client-supplied MIME type rather than inspecting the actual file contents.
An attacker who already holds administrative access can abuse this gap to upload a PHP file disguised as an image, bypassing the upload filter and achieving code execution on the underlying web server.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-103522 |
| Severity | High |
| CVSS Score | 7.2 |
| Weakness | CWE-434 (Unrestricted Upload of File with Dangerous Type) |
| Attack Vector | Network |
| Privileges Required | High (administrative access) |
| User Interaction | None |
| Patch Status | Not yet available |
How It Works
When an admin uploads a store banner image, Thelia checks the file's MIME type as reported by the client request rather than verifying the file's actual content or extension server-side. Because that check can be trivially spoofed, an attacker with admin credentials can upload a .php file with a forged image/* MIME type. If the upload directory is web-accessible and the server executes PHP there, the attacker can then request the uploaded file directly to trigger code execution.
This issue was disclosed alongside a related upload-validation flaw (CVE-2026-103521) as part of CERT/CC advisory VU#162329, which covers multiple file-handling, templating, and administrative-workflow vulnerabilities across Thelia 2.6.0 and 2.6.1.
Impact Assessment
Who Is At Risk
Because exploitation requires administrative access, the primary risk scenarios are:
- Environments where admin credentials have already been phished, reused, or otherwise compromised
- Multi-tenant or agency-managed Thelia installs where lower-trust admin accounts exist
- Deployments where privilege separation between "store manager" and "full admin" roles is weak
Potential Attack Chains
- Admin Access Obtained — Via credential reuse, phishing, or an unrelated privilege-escalation bug
- Malicious Upload — A PHP webshell disguised as an image is uploaded through the store banner feature
- Code Execution — The attacker requests the uploaded file directly, triggering server-side PHP execution
- Full Server Compromise — Webshell access enables data theft, lateral movement, or persistent backdoor installation
Mitigation
Immediate Actions
- Restrict administrative access — tightly control who holds admin credentials and enforce MFA on admin accounts
- Disable or monitor the banner upload feature where it isn't actively needed
- Audit upload directories for unexpected
.phpor other executable files - Watch CERT/CC and Thelia's own release channels for a patch, since none is currently available
Detection Opportunities
- Monitor for file uploads with mismatched extension/content-type combinations
- Check web server logs for direct requests to files in image upload directories that return PHP-generated responses
- Review admin account activity logs for uploads occurring outside normal administrative workflows
Defence-in-Depth
- Configure the web server to never execute scripts from upload directories (e.g., via
.htaccessrules or PHP-handler exclusions) - Validate uploaded files server-side by content/magic-byte inspection, not client-supplied MIME type, as a general practice beyond this specific patch
- Apply least-privilege principles to admin roles so a single compromised account can't reach sensitive upload features
Background
CVE-2026-103522 is one of several file-handling and workflow vulnerabilities covered in CERT/CC's VU#162329 advisory for Thelia 2.6.0 and 2.6.1, which together could enable remote code execution, server-side template injection, and cross-site scripting depending on the specific flaw chained. Since no vendor patch is available yet, administrators should prioritize the compensating controls above — particularly locking down who holds admin access and ensuring upload directories cannot execute code — until a fix ships.