AI analysis
Thelia v2.6.0 validates file types on its document upload endpoint but skips the same validation on the document update endpoint, allowing a privileged attacker to upload executable files such as malicious PHP scripts. The flaw is triggered by an administrative user (or an attacker who has compromised admin credentials) updating an existing document with an executable payload. Successful exploitation yields remote code execution on the web server hosting the Thelia e-commerce installation. Affected deployments are Thelia 2.6.0 (and per related CERT advisory coverage, 2.6.1 as well). No public proof of concept or known in-the-wild exploitation has been reported.
What to do: Upgrade to a Thelia release that fixes the validation gap in the document update endpoint (check with the vendor for the patched version, as only 2.6.0/2.6.1 are confirmed vulnerable). Restrict administrative access to trusted users and networks, enforce strong authentication and MFA on admin accounts, and audit the document/document update directories for unexpected executable files or recently modified PHP scripts.
Estimated exposure
nichelikely on the order of a few thousand public Thelia installations — Thelia is a niche open-source French e-commerce CMS with no published active-install statistics; exposure is limited to a small self-hosted installed base, so this is a low-confidence order-of-magnitude guess.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.