Key points
- Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities related to file management and administrative workflows.
- Successful exploitation could enable remote code execution, server-side template injection, and cross-site scripting.
- The CERT/CC advisory lists several CVEs including issues with file upload validation and Smarty template handling.
The CERT/CC issued advisory VU#162329 detailing multiple vulnerabilities in Thelia versions 2.6.0 and 2.6.1. These flaws affect file management, Smarty templating, module installation, and administrative workflows. Exploitation could lead to remote code execution, server-side template injection, stored and reflected cross-site scripting, and unauthorized URL redirection.
By the numbers
- 2.6.0 and 2.6.1 are the specific Thelia versions affected by the reported vulnerabilities.
- Multiple CVEs are cited in the CERT/CC advisory, including CVE-2026-103521 through CVE-2026-103529.
- The advisory highlights risks to both server-side and client-side attack surfaces for merchants using this platform.
What the figures mean
In Thelia v2.6.0, the document upload endpoint blocks executable files, but the document update endpoint lacks this validation. An attacker with administrative permissions can exploit CVE-2026-103521 to upload arbitrary executable files, such as malicious PHP scripts, achieving remote code execution on the server. This inconsistency in validation creates a significant security gap for administrators managing documents.
CVE-2026-103522 affects the store banner upload feature in Thelia v2.6.0. The feature relies exclusively on client-supplied MIME types for filetype validation. An attacker with administrative access can upload a PHP file disguised as an image to bypass this check. This allows the execution of remote code on the underlying server through insufficient validation mechanisms.
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow, identified as CVE-2026-103523. After submitting the "Add New Address" form, the application redirects users to a URL specified in the next parameter. Because the application does not validate the destination against an allowlist, attackers can redirect users to arbitrary external websites.
Multiple stored XSS vulnerabilities exist in Thelia v2.6.0's administrative interface, labeled CVE-2026-103524. User-supplied input is stored without sufficient output encoding or sanitization. This allows arbitrary JavaScript execution when affected pages, such as product pages or category creation interfaces, are viewed by administrators or customers.
CVE-2026-103526 reveals that Thelia v2.6.0's administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords. This allows unauthenticated attackers to enumerate valid administrator accounts. The lack of rate limiting enables efficient, large-scale username enumeration against the authentication system.
Thelia v2.6.0's Smarty templates fail to properly escape double quotes in the next parameter, causing reflected XSS. CVE-2026-103527 notes that when an authenticated user visits a malicious link containing attacker-controlled JavaScript, the code executes. This affects address.html and address-update.html templates within the application.
CVE-2026-103528 describes how Thelia 2.6.0 uses Smarty for email templates without restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions via the messages configuration interface. When rendered, functions like system() and exec() can execute arbitrary OS commands with web process privileges.
Thelia v2.6.0 permits authenticated administrators to upload and install modules via ZIP without validating embedded PHP code. CVE-2026-103529 indicates that this lack of sandboxing or validation allows arbitrary code execution. This creates a direct path for attackers to compromise the server through module installation workflows.
What to watch
The CERT/CC advisory does not confirm the existence of a patch or fix for these vulnerabilities. Security teams should monitor official Thelia channels for updates. The range of issues from file upload flaws to template injection suggests a broad exposure for administrators.
Background: Sandboxing
Sandboxing runs suspicious files in an isolated environment to observe behavior without risking the host system. It catches zero-day exploits by monitoring actions rather than signatures. However, it fails against polymorphic malware that detects virtualization and remains dormant. Use it as a detection layer, not a prevention barrier.
Read the full guide: Sandboxing: Why It Fails and When It Actually Protects You
What to do and how to stay safe: Thelia
- Review administrative access logs for unusual file uploads or module installations in Thelia 2.6.0 and 2.6.1 environments.
- Restrict administrative privileges to minimize the number of users who can perform high-risk actions like module installation.
- Monitor for unexpected redirects or JavaScript execution in address creation and email template preview workflows.
- Wait for vendor confirmation of a security update before applying any changes to production e-commerce systems.
Step-by-step guide: Open Redirect Response: Containment, Recovery and Prevention Steps
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Thelia are affected by these vulnerabilities?
Thelia versions 2.6.0 and 2.6.1 are affected by the multiple vulnerabilities detailed in the CERT/CC advisory.
Can attackers execute remote code through these flaws?
Yes, successful exploitation of issues like CVE-2026-103521 and CVE-2026-103528 can enable remote code execution on the server.
Is there a patch available for these vulnerabilities?
The source material does not state that a patch or fix has been confirmed or released yet.
