CVE-2026-103535
8.8HighPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-94, CWE-434
Impact
Authenticated users with translation update permissions can execute arbitrary PHP code as the web server user. Attackers require network access and an account with UPDATE privileges on admin.configuration.language.
Root cause
The translation editor fails to sanitize directory traversal sequences in item_name and does not escape backslashes when writing user input into PHP translation files.
Affected systems
Thelia v2.6.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to a patched release if available; alternatively, revoke UPDATE permissions on admin.configuration.language from untrusted accounts or restrict admin access to trusted networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.