CVE-2026-103521
CVE-2026-103521
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.
| Vendor | thelia |
| Product | thelia |
| Published | Oct 12, 2026 |
| Last Updated | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for thelia thelia
Be the first to know when new high vulnerabilities affecting thelia thelia are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Thelia / Thelia
0 ≤ 2.6.0