CERT/CC details unpatched remote code execution flaws in Thelia 2.6.0 and 2.6.1

CERT/CC has published an advisory, dated 12 October 2026 and summarized on dev.to, describing a cluster of vulnerabilities in Thelia 2.6.0 and 2.6.1, an open-source PHP e-commerce platform, that can end in remote code execution on the web server. The advisory assigns eleven CVEs to the problems, rates the overall severity as critical, and states that no vendor fix has been released. Japan's JVN is listed as related information.

Four routes to code execution

Most of the code execution paths require the attacker to already hold Thelia administrator or limited-administrator privileges. CERT/CC groups them as follows.

File uploads and module installation: an attacker with admin access can place a PHP file in a web-executable location through the document update or banner upload features, or upload a module ZIP archive containing malicious PHP. Requesting the uploaded file over the web, or completing the module installation, runs the code with web server privileges.

Smarty email templates: the message configuration screen lets an administrator store a Smarty expression inside an email template. When that template is previewed or rendered, unrestricted functions such as system(), exec(), or file_put_contents() run within the web process.

Translation editor: a user holding the admin.configuration.language UPDATE permission can supply dot-dot-slash sequences in the item_name parameter to direct writes to a web-accessible path outside the templates directory. Because translation values are not properly escaped for backslashes, an attacker can break out of the generated PHP string literal, have the editor write a malicious PHP file, and then execute it by requesting its URL.

Absolute-path SSTI: validation in checkTemplate() blocks only relative directory traversal. An authorized user who supplies an absolute filesystem path instead causes Smarty to load and compile that file without security policies, executing template code with web server privileges.

Which versions are affected

According to CERT/CC, the document upload issue (CVE-2026-103521), the banner upload issue (CVE-2026-103522), the email template flaw (CVE-2026-103528) and the module installation flaw (CVE-2026-103529) affect Thelia 2.6.0. The translation editor flaw (CVE-2026-103535) and the absolute-path Smarty SSTI (CVE-2026-103537) affect 2.6.1. The advisory lists five further identifiers (CVE-2026-103523, CVE-2026-103524, CVE-2026-103526, CVE-2026-103527 and CVE-2026-107248) whose individual version and privilege preconditions should be checked against the advisory itself.

Not everything requires a login: CERT/CC notes that username enumeration and certain browser-facing attacks can be initiated without authentication, and the broader advisory covers issues such as open redirects and stored cross-site scripting on product pages.

Recommended mitigations

With no patch available, the guidance centers on reducing exposure:

• Keep the administrative interface off the public internet, behind a VPN, an IP allowlist and multi-factor authentication.
• Restrict or withdraw permissions for document, banner, module, template and translation management.
• Disable PHP execution in directories that users or admins can write to, and validate MIME types, file extensions and file content on the server rather than trusting the client.

Detection guidance

CERT/CC states that the advisories it reviewed contain no reports of active exploitation in the wild. For defenders, candidate indicators include email template modifications and unusual preview or render events, admin login and password-reset enumeration, requests to document, banner, module and translation endpoints, newly reachable PHP URLs, modified PHP files in web roots, compiled Smarty templates, module installation artifacts and web server child processes. The advisory stresses correlating requests with evidence of actual command execution before concluding an attack succeeded — an upload or edit request on its own is not proof of compromise.

Why it matters

This is a set of critical, currently unpatched remote code execution paths in e-commerce software, which places orders, customer records, credentials and payment-related data directly at risk if exploited. Although most paths demand admin-level access, the accompanying unauthenticated issues — username enumeration, open redirects and stored XSS that can enable session hijacking — offer plausible stepping stones toward an admin session. Until a vendor patch ships, isolating the admin interface, shrinking permissions and blocking PHP execution in writable directories are the primary defenses for any deployment still running Thelia 2.6.0 or 2.6.1.