Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution

Overview

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The item_name parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../. This enables an authenticated user with UPDATE-level permissions on admin.configuration.language to write files outside the expected templates/ directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape \ in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.