Path Traversal and PHP Code Injection in Thelia Translation Editor

CVE-2026-103535

What is CVE-2026-103535?

Thelia v2.6.1 features critical security flaws in its translation editor, specifically allowing for path traversal and PHP code injection. The lack of proper sanitization for directory traversal sequences in the item_name parameter enables authenticated users with UPDATE permissions to write files to unintended locations, including web-accessible paths. Additionally, the translation-writing logic does not adequately escape backslashes in user-inputted values, which can facilitate the injection of executable PHP code into translation files. When exploited together, these vulnerabilities could permit an attacker to create and execute a malicious PHP file with the web server's privileges, posing a severe risk to the integrity and security of the affected systems.

References