Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · CERT/CC Vulnerability Notes

   Detected

   Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose

2. Oct 15, 2026 · NIST NVD

   Updated

   Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.

Sources

• CERT/CC Vulnerability NotesGovernment advisoryCVE-2026-103529

  Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template inje

  kb.cert.org
• CVE.orgVulnerability recordCVE-2026-103529

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-103529

  Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's method which will then be executed upon installati

  nvd.nist.gov

References

• Reference · kb.cert.org