CVE-2026-103535

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The item name parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../. This enables an authenticated user with UPDATE-level permissions on admin.configuration.language to write files outside the expected templates/ directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.