Insufficient Filetype Validation in Thelia Leading to Remote Code Execution

CVE-2026-103522

What is CVE-2026-103522?

In Thelia version 2.6.0, a significant vulnerability exists within the store banner upload feature. This flaw allows an attacker with administrative access to exploit insufficient validation of file types, relying solely on client-supplied MIME types. By uploading a malicious PHP file masquerading as an image, the attacker can successfully bypass the validation process, leading to remote code execution on the affected server. This poses a serious risk to the integrity and security of the host system.

References