Remote Code Execution Vulnerability in Thelia v2.6.0 by Thelia

CVE-2026-103529

What is CVE-2026-103529?

Thelia version 2.6.0 contains a vulnerability that allows authenticated administrators to upload and install modules through a ZIP upload feature without proper validation or sandboxing of embedded PHP code. This deficiency permits an attacker to embed malicious PHP code in a module's install method, which can be executed during installation, consequently enabling remote code execution with the server's privileges. Ensuring proper validation and security measures during module uploads is crucial to mitigate this risk.

References