Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-109397: Thelia admin can upload and run malicious PHP files

CVE-2026-109397 · published 4 days ago

Summary

In Thelia versions earlier than 3.1.2 and 3.2.1, a back‑office user can add a space to the end of a file name and upload a PHP file that the system saves as an executable script. This lets the user run code on the web server, potentially taking control of the site. Upgrade Thelia to the latest release or restrict file‑upload capabilities to prevent this risk.

What to do

Update thelia thelia to version 3.1.2 or later.

Affected software

Vendor	Product	Affected versions
thelia	thelia	< 3.1.2

Original advisory text

Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

References

https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/File/Service/Fi... Third Party Advisory
https://github.com/thelia/thelia/commit/6b706f5cb96e6b12d890c6d16edb1c9d1fd8191a Patch
https://github.com/thelia/thelia/commit/b71258902b5dd278007d0f37ddad45f76d06d5bc Patch
https://github.com/thelia/thelia/releases/tag/3.1.2 Vendor Advisory
https://github.com/thelia/thelia/releases/tag/3.2.1 Vendor Advisory
https://github.com/thelia/thelia/security/advisories/GHSA-5524-qfxp-33v9 Vendor Advisory
https://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1093... Vendor Advisory
https://github.com/thelia/thelia Product
https://nvd.nist.gov/vuln/detail/CVE-2026-109397 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-434Unrestricted File Upload

Timeline

Published12 Oct 2026

Updated15 Oct 2026

First seen12 Oct 2026

Sources

CVE-2026-109397 · NVD

CVE-2026-109397 · MITRE

CVE-2026-109397 · OSV

GHSA-5524-qfxp-33v9 · GHSA

Track software like this

Free during beta