CERT/CC warns that multiple flaws in Thelia e-commerce software allow attackers to execute code, steal credentials, and hijack user sessions.
Key points
- Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities enabling remote code execution and cross-site scripting.
- Administrative users can upload malicious PHP files through document and banner upload endpoints.
- Unauthenticated attackers can enumerate administrator accounts due to inconsistent error messages.
CERT/CC published an advisory detailing multiple security flaws in Thelia versions 2.6.0 and 2.6.1. These issues affect file management, templating, and administrative workflows, exposing merchants to significant compromise risks.
What happened
Thelia versions 2.6.0 and 2.6.1 contain vulnerabilities in file handling and Smarty templating, according to CERT/CC. The agency notes that successful exploitation could enable remote code execution, server-side template injection, and cross-site scripting.
CVE-2026-103521 allows administrators to upload executable files via the document update endpoint, which lacks validation present in the upload endpoint. CVE-2026-103522 permits PHP file uploads through the store banner feature by relying on client-supplied MIME types.
CVE-2026-103528 enables authenticated administrators to execute operating system commands by injecting malicious Smarty expressions into email templates. CVE-2026-103529 allows module installation via ZIP upload without validating embedded PHP code.
CVE-2026-103523 introduces an open redirect vulnerability in the address creation workflow. CVE-2026-103524 and CVE-2026-103527 involve stored and reflected cross-site scripting flaws in administrative interfaces and address templates.
CVE-2026-103526 allows unauthenticated attackers to enumerate valid administrator accounts. The login and password reset endpoints return different responses for invalid usernames versus incorrect passwords, and lack rate limiting.
Why it matters
Thelia is an open-source e-commerce platform used by merchants for storefronts and product management. The combination of remote code execution and credential enumeration flaws exposes both server-side and client-side attack surfaces.
Administrators with compromised accounts could upload malicious scripts or inject dangerous PHP functions into email templates. This could lead to full server compromise, data theft, or unauthorized file operations on the underlying system.
The fix
- Review administrative access logs for unusual file uploads or module installations.
- Monitor server processes for unexpected command executions or new PHP files.
- Implement rate limiting on authentication endpoints to hinder account enumeration.
- Restrict administrative privileges to reduce the attack surface for upload flaws.
What to do and how to stay safe: Thelia
- Audit all administrative accounts and enforce multi-factor authentication immediately.
- Scan uploaded files and server directories for unauthorized PHP scripts or executables.
- Review email template configurations for malicious Smarty expressions or code injection.
- Monitor web server logs for open redirect attempts and suspicious user agent strings.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Thelia versions are affected by these vulnerabilities?
Thelia versions 2.6.0 and 2.6.1 are affected by multiple vulnerabilities, according to CERT/CC.
Can unauthenticated attackers exploit these flaws?
Unauthenticated attackers can enumerate administrator accounts via CVE-2026-103526, but other flaws require administrative or authenticated access.
Is there a patch available for these issues?
The source material does not confirm the availability of a patch or update for these vulnerabilities.
