CVE-2026-103522highCWE-434

CVE-2026-103522: high-severity vulnerability in Thelia

CVE-2026-103522

Published

Follow this CVE+ Monitor Thelia

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.6%
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Thelia · Thelia
Related CVEs — Thelia

In the same product, most dangerous first.

CVE-2026-103535HIGHCVE-2026-103535EPSS 1.1%CVE-2026-103521HIGHCVE-2026-103521EPSS 0.6%CVE-2026-103537MEDIUMCVE-2026-103537EPSS 0.6%CVE-2026-103528MEDIUMCVE-2026-103528EPSS 0.5%CVE-2026-107248HIGHCVE-2026-107248EPSS 0.5%CVE-2026-109397HIGHThelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing SpaceEPSS 0.4%