Unrestricted File Upload Vulnerability in Thelia by Thelia Team

CVE-2026-109397

What is CVE-2026-109397?

Thelia, a popular PHP framework, has a security flaw that allows authenticated back-office users to upload malicious PHP files by manipulating the filename. Specifically, the vulnerability arises from the improper handling of trailing spaces in filenames, which the system fails to effectively validate. As a result, an uploaded PHP file can be stored in a publicly accessible directory, leading to potential arbitrary code execution by the web server. Users are encouraged to upgrade to Thelia version 3.1.2 or 3.2.1 to mitigate this risk.

References