CVE-2026-103535

Summary

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. An authenticated user with UPDATE permissions can write malicious PHP files outside the expected directory and execute them with web-server privileges.

Exploitability

Exploitation requires an authenticated user with UPDATE-level permissions on admin.configuration.language, which is moderately difficult but achievable through social engineering or credential compromise.

Blast radius

The vulnerability affects all Thelia installations using the translation editor feature, potentially allowing attackers to execute arbitrary code as the web server user and gain full control over the application's data and functionality.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to 2.6.1.1 or later to receive the patched version that addresses both the path traversal and PHP injection flaws in the translation editor.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.