---
id: CVE-2026-103521
title: >-
  In Thelia v2.6.0, the document upload endpoint properly blocks the upload of
  executable file types, but the document update endpoint does not perform the
  same validation
summary: >-
  In Thelia v2.6.0, the document upload endpoint properly blocks the upload of
  executable file types, but the document update endpoint does not perform the
  same validation. An attacker with administrative Thelia permissions can
  exploit thi…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-434
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:17:05.503'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103521'
references:
  - url: 'https://kb.cert.org/vuls/id/162329'
    label: cret@cert.org
tags:
  - nvd
ingestedAt: '2026-10-12T15:55:08.153Z'
---

## Overview

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.