Thelia: Path traversal and PHP code injection in translation editor enable RCE
Summary
Thelia 2.6.1 contains path traversal and PHP code injection flaws in its translation editor that can be chained into remote code execution. An authenticated user with UPDATE rights on admin.configuration.language can write a malicious PHP file to a web-accessible path and run it with web server privileges. The attack requires a valid back-office account with that permission.
Affected
- Thelia 2.6.1 (CVE record range: up to and including 2.6.1)
- Version 2.6.0 is not confirmed by the CVE record; treat as in scope until the vendor states otherwise
Fixed in
Unknown. No fixed version is confirmed in the available sources.
Workaround
- Restrict access to the Thelia back office (VPN or IP allowlist)
- Remove UPDATE rights on admin.configuration.language from accounts that do not need them
- Check the web root and writable directories for unexpected PHP files
Exploitation
- Not known to be exploited; not listed in CISA KEV
- CISA SSVC: exploitation none, automatable no, technical impact total
- No public proof of concept found in a limited search
Our recommendation
- Restrict back-office access to trusted networks and remove unneeded admin rights
- Audit translation files and the web root for unexpected PHP files and recent changes
- Monitor for new Thelia releases and apply the vendor fix as soon as it is available
- Consult CERT/CC VU#162329 for current details
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT/CC VU#162329 kb.cert.org
- OpenCVE CVE record app.opencve.io
- HOL CVE details hol.org
- Strix CVE-2026-103535 www.strix.ai
- GitHub alert (EPSS, KEV) github.com
- Offseq summary of CERT note radar.offseq.com
- Vulners VULNRICHMENT CVE-2026-103535 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:27.
Original description (NVD)
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.