PT-2026-110615 · Thelia · Thelia
CVE-2026-103529
·
Published
2026-10-12
·
Updated
2026-10-12
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's
install() method which will then be executed upon installation, enabling remote code execution with the privileges of the web server. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Thelia