CVE-2026-103535
Summary
| CVE | CVE-2026-103535 |
|---|---|
| State | PUBLISHED |
| Assigner | certcc |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-12 15:17:06 UTC |
| Updated | 2026-10-12 15:17:06 UTC |
| Description | Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges. |
Risk And Classification
Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CWE-94 Improper Control of Generation of Code ('Code Injection')
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| kb.cert.org/vuls/id/162329 | [email protected] | kb.cert.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.