{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/thelia--3.1.2-3.2.x--3.2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:thelia:thelia:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109397"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Thelia (\u003c 3.1.2, 3.2.x \u003c 3.2.1)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","remote-code-execution","file-upload"],"_cs_type":"advisory","_cs_vendors":["Thelia"],"content_html":"\u003cp\u003eThelia versions before 3.1.2 and 3.2.x before 3.2.1 are vulnerable to an unrestricted file upload flaw (CVE-2026-109397). This vulnerability exists because the FileProcessorService performs filename validation on the raw input, while the subsequent FileManager::sanitizeFileName() function strips trailing spaces from the filename. An authenticated back-office user can exploit this discrepancy by appending a trailing space to a malicious PHP file's name. This causes the file to pass initial validation, after which the sanitization process converts it into a valid, executable .php file. The file is then stored in the public/cache/documents/ directory, where it can be directly accessed and executed by the web server, resulting in remote code execution with the permissions of the web server user.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an authenticated back-office user to gain full remote code execution on the underlying web server. This can lead to complete compromise of the e-commerce platform, including unauthorized access to customer data, system configuration modification, and further lateral movement within the network. The severity is rated as high due to the potential for full system compromise from a common administrative interface.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Thelia to version 3.1.2 or 3.2.1 immediately to patch CVE-2026-109397.\u003c/li\u003e\n\u003cli\u003eReview access logs and application logs for suspicious file uploads or direct access requests to files located within the /public/cache/documents/ directory.\u003c/li\u003e\n\u003cli\u003eRestrict access to the back-office administrative portal to trusted internal IP addresses and implement multi-factor authentication to reduce the likelihood of unauthorized account access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:33:51Z","date_published":"2026-10-12T18:33:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-thelia-file-upload/","summary":"An unrestricted file upload vulnerability in Thelia allows authenticated back-office users to achieve remote code execution by bypassing filename sanitization.","title":"Unrestricted File Upload Vulnerability in Thelia","url":"https://feed.craftedsignal.io/briefs/2026-10-thelia-file-upload/"}],"language":"en","title":"CraftedSignal Threat Feed - Thelia (\u003c 3.1.2, 3.2.x \u003c 3.2.1)","version":"https://jsonfeed.org/version/1.1"}