Unrestricted File Upload Vulnerability in Thelia

Thelia versions before 3.1.2 and 3.2.x before 3.2.1 are vulnerable to an unrestricted file upload flaw (CVE-2026-109397). This vulnerability exists because the FileProcessorService performs filename validation on the raw input, while the subsequent FileManager::sanitizeFileName() function strips trailing spaces from the filename. An authenticated back-office user can exploit this discrepancy by appending a trailing space to a malicious PHP file's name. This causes the file to pass initial validation, after which the sanitization process converts it into a valid, executable .php file. The file is then stored in the public/cache/documents/ directory, where it can be directly accessed and executed by the web server, resulting in remote code execution with the permissions of the web server user.

Impact

Successful exploitation of this vulnerability allows an authenticated back-office user to gain full remote code execution on the underlying web server. This can lead to complete compromise of the e-commerce platform, including unauthorized access to customer data, system configuration modification, and further lateral movement within the network. The severity is rated as high due to the potential for full system compromise from a common administrative interface.

Recommendation

• Upgrade Thelia to version 3.1.2 or 3.2.1 immediately to patch CVE-2026-109397.
• Review access logs and application logs for suspicious file uploads or direct access requests to files located within the /public/cache/documents/ directory.
• Restrict access to the back-office administrative portal to trusted internal IP addresses and implement multi-factor authentication to reduce the likelihood of unauthorized account access.