{"id":"CVE-2026-103535","title":"Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution","summary":"Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does…","severity":"none","published":"2026-10-12","updated":"2026-10-13","sourceUpdated":"2026-10-13T13:51:00.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103535","references":[{"url":"https://kb.cert.org/vuls/id/162329","label":"cret@cert.org"}],"tags":["nvd"],"epss":0.00474,"epssPercentile":0.3922,"ingestedAt":"2026-10-12T15:55:08.155Z","slug":"CVE-2026-103535","body":"## Overview\n\nThelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}