CVE-2026-103529
5.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-434
Impact
Authenticated administrators can execute arbitrary code as the web server user. They need administrative access to upload and install a malicious module ZIP file.
Root cause
The module ZIP upload feature installs packages without validating or sandboxing embedded PHP code in the module's install method.
Affected systems
Thelia v2.6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade to a patched version once provided by the vendor. In the interim, restrict access to the admin interface or disable module uploads via web server access controls.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.