AI analysis
Thelia v2.6.0, an open-source PHP e-commerce platform, performs insufficient validation on the store banner upload feature, relying exclusively on client-supplied MIME types. An attacker with administrative credentials can upload a PHP file disguised as an image (e.g., by manipulating the MIME type header), bypassing validation and achieving remote code execution on the underlying server. Exploitation requires high privileges (PR:H), so it primarily enables a compromised admin account to escalate to full server control. All deployments of Thelia 2.6.0 (and, per related advisory VU#162329, likely 2.6.1) are affected. No public proof of concept or in-the-wild exploitation is known.
What to do: Upgrade beyond Thelia 2.6.0 (check for a vendor patch addressing the banner upload validation, per VU#162329). Restrict administrative access to trusted users and networks, enable authentication with strong credentials and MFA where possible, and audit the server for previously uploaded files with PHP extensions or image files containing PHP code in upload directories.
Estimated exposure
nicheunknown; likely low thousands of sites at most — Thelia is a self-hosted French open-source e-commerce CMS with a relatively small install base and no public active-install counts available, so the number of exposed installations cannot be reliably estimated.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.