AI analysis
Thelia v2.6.1 contains a path traversal flaw in its translation editor: the `item_name` parameter is used to build the translation file's write path without sanitizing `../` sequences, allowing an authenticated user with UPDATE-level permissions on `admin.configuration.language` to write files outside the intended `templates/` directory. The translation-writing logic also fails to escape backslashes in user-supplied values, letting an attacker break out of a PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web server's privileges, giving full remote code execution. Affected deployments are Thelia 2.6.0 and 2.6.1 installations where translation editing is reachable by an administrative user. No public proof of concept or in-the-wild exploitation is known, and the vulnerability has not yet been assigned a CVSS score or added to the CISA KEV catalog.
What to do: Upgrade to a Thelia version newer than 2.6.1 as soon as a patched release is available, and check the CERT-FR advisory VU#162329 for updates. Restrict access to the translation editor so only fully trusted administrators hold UPDATE permissions on `admin.configuration.language`, and audit the `templates/` directory and other web-accessible paths for recently written or unexpected PHP files. Consider web-tier controls (WAF rules for `../` sequences in admin parameters) as a temporary mitigation.
Affected
| Thelia | 2.6.1 |
| Thelia | 2.6.0 (per VU#162329) |
Estimated exposure
nicheunknown; likely on the order of thousands of Thelia e-commerce sites at most — Thelia is an open-source French e-commerce CMS with a relatively small install base and no public active-install or scan data available, so the exact count is unknown but well below mass-market platforms.
Description
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.