CVE-2026-103522 is listed by VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · CERT/CC Vulnerability Notes

   Detected

   Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose

Sources

• CERT/CC Vulnerability NotesGovernment advisoryCVE-2026-103522

  Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template inje

  kb.cert.org
• CVE.orgVulnerability recordCVE-2026-103522

  Official CVE identifier

  cve.org