CVE-2026-109397highCWE-434

CVE-2026-109397: falha de alta gravidade em Thelia

Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Thelia

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.4%
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Thelia · Thelia
CVEs relacionadas — Thelia

No mesmo produto, das mais perigosas para as menos.

CVE-2026-103535HIGHCVE-2026-103535EPSS 1.1%CVE-2026-103521HIGHCVE-2026-103521EPSS 0.6%CVE-2026-103522HIGHCVE-2026-103522EPSS 0.6%CVE-2026-103537MEDIUMCVE-2026-103537EPSS 0.6%CVE-2026-103528MEDIUMCVE-2026-103528EPSS 0.5%CVE-2026-107248HIGHCVE-2026-107248EPSS 0.5%