CERT/CC Details 8 Thelia 2.6 Flaws Enabling RCE, XSS and Admin Account Enumeration
The CERT/CC advisory details eight vulnerabilities in Thelia 2.6.0 and 2.6.1 that enable remote code execution, cross-site scripting, and account enumeration.
Key points
- Thelia versions 2.6.0 and 2.6.1 contain eight distinct security flaws, including remote code execution and cross-site scripting issues.
- Administrative access is required to exploit the remote code execution vulnerabilities involving file uploads and template injection.
- Unauthenticated attackers can enumerate valid administrator accounts due to inconsistent error responses and a lack of rate limiting.
The CERT/CC has published advisory VU#162329, identifying eight vulnerabilities in Thelia versions 2.6.0 and 2.6.1. These flaws affect file management, Smarty templating, module installation, and administrative workflows, potentially allowing remote code execution, server-side template injection, cross-site scripting, and unauthorized redirects.
At a glance
- Publisher
- CERT/CC
- CVEs
- See advisory
The most severe issues enable remote code execution on the underlying server. CVE-2026-103521 allows an attacker with administrative permissions to upload arbitrary executable files, such as malicious PHP scripts, via the document update endpoint. Although the document upload endpoint blocks executable types, the update endpoint lacks this validation, according to the CERT/CC advisory.
CVE-2026-103522 permits remote code execution through the store banner upload feature. This function relies exclusively on client-supplied MIME types for file type validation. An attacker with administrative access can disguise a PHP file as an image to bypass these checks and execute code on the server, the advisory states.
Template and Module Risks
Thelia 2.6.0 also suffers from vulnerabilities in its Smarty template engine and module installation process. CVE-2026-103528 allows authenticated administrators to inject malicious Smarty expressions into email templates via the messages configuration interface. When these templates are previewed or rendered, dangerous PHP functions like system() and exec() can be executed with web process privileges.
Additionally, CVE-2026-103529 reveals that the ZIP upload function for module installation does not validate or sandbox embedded PHP code. Authenticated administrators can upload and install modules containing malicious PHP code, leading to arbitrary OS command execution and remote code execution on the server, according to the CERT/CC.
Cross-Site Scripting and Enumeration
Several flaws expose users to cross-site scripting and account enumeration attacks. CVE-2026-103524 involves multiple stored XSS vulnerabilities within the administrative interface. User-supplied input in category and product creation is stored without sufficient encoding, allowing arbitrary JavaScript execution when administrators or customers view affected pages.
CVE-2026-103527 enables reflected XSS in the address.html and address-update.html Smarty templates. These templates fail to properly escape double quotes in the next parameter, allowing attacker-controlled JavaScript to execute when an authenticated user visits a malicious link.
Furthermore, CVE-2026-103526 allows unauthenticated attackers to enumerate valid administrator accounts. The administrative login and forgotten password endpoints return different responses for invalid usernames versus incorrect passwords. The lack of rate limiting enables efficient, large-scale username enumeration, the advisory notes.
What should you do?
The CERT/CC advisory does not confirm that a patched version of Thelia is available. Administrators of Thelia 2.6.0 and 2.6.1 should restrict administrative access to trusted networks and monitor for suspicious file uploads or template modifications. Organizations should also review server logs for evidence of unauthorized code execution or unusual redirect patterns.
What to do and how to stay safe: Thelia
- Restrict administrative access to Thelia instances to trusted IP addresses or networks to reduce the attack surface for RCE flaws.
- Monitor server logs for unexpected file uploads, particularly PHP scripts, or unusual execution patterns in template rendering processes.
- Implement rate limiting on login and password reset endpoints to mitigate the risk of administrator account enumeration attacks.
- Review and sanitize all user-supplied input in category and product creation forms to prevent stored cross-site scripting vulnerabilities.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Thelia are affected by these vulnerabilities?
Thelia versions 2.6.0 and 2.6.1 are affected by the eight vulnerabilities detailed in CERT/CC advisory VU#162329.
Can unauthenticated attackers exploit these flaws?
Unauthenticated attackers can exploit CVE-2026-103526 to enumerate administrator accounts, but remote code execution flaws require administrative access.
Is there a patch available for these issues?
The CERT/CC advisory does not state that a fix or updated version has been released for these vulnerabilities.
