---
id: CVE-2026-103535
title: >-
  Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities
  in its translation editor that can be chained to achieve remote code execution
summary: >-
  Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities
  in its translation editor that can be chained to achieve remote code
  execution. The `item_name` parameter, used to build the translation file's
  write path, does…
severity: none
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:17:06.560'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103535'
references:
  - url: 'https://kb.cert.org/vuls/id/162329'
    label: cret@cert.org
tags:
  - nvd
ingestedAt: '2026-10-12T15:55:08.155Z'
---

## Overview

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.