Thelia: Unrestricted file upload leads to remote code execution

Summary

Thelia, an open-source PHP e-commerce platform, does not reliably block PHP files uploaded through the back office. Appending a trailing space to a filename bypasses the extension check, and the file is stored as an executable .php file under public/cache/documents/. An authenticated back-office user can therefore run code as the web server user on the shop host. The attacker needs a back-office account, so the risk depends on how well those accounts and the back-office login are protected.

Affected

• Thelia versions before 3.1.2
• Thelia 3.2.0 to before 3.2.1

Fixed in

• Upgrade to Thelia 3.1.2 (3.1 line)
• Upgrade to Thelia 3.2.1 (3.2 line)

Workaround

Unknown. No vendor workaround is documented. Interim measures (own recommendation, not from the vendor): restrict back-office access to VPN or IP allowlists, enforce MFA, reduce back-office accounts to the minimum, and configure the web server so it does not execute PHP in upload and cache directories.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No evidence of exploitation in the wild was found.
• Public PoC status is conflicting between sources and was not verified.
• The CISA KEV status was not checked directly.
• EPSS is about 0.0044 (low).

Our recommendation

• Identify all Thelia instances and their versions.
• Upgrade to 3.1.2 or 3.2.1, as applicable. The 3.2.1 release also fixes a CSV formula-injection issue (GHSA-gcgv-f8rf-w2wc).
• Note that the update blocks new uploads of this kind but does not remove files already stored. Search the media and cache directories for server-executable files such as .php uploaded before the update, and remove any unexpected ones after investigation.
• Restrict back-office access to trusted networks or VPN and enforce MFA.
• Monitor the web server for unexpected PHP files and processes started by the web server user.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-5524-qfxp-33v9 github.com
• VulnCheck advisory: Thelia file upload RCE via filename trailing space www.vulncheck.com
• Thelia release 3.1.2 github.com
• Thelia release 3.2.1 github.com
• Thelia commit 6b706f5 (upload check against stored name) github.com
• OSV entry CVE-2026-109397 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:47.