CVE-2026-109397GHSA-5524-qfxp-33v9
Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
Thelia Thelia
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.44%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.
Text from CVE List
Affected versions 2
- Theliaaffected: all versions before 3.1.2CVE List
- Theliaaffected: 3.2.0 before 3.2.1CVE List
References 7
- github.com/thelia/thelia/commit/6b706f5cb96e6b12d890c6d16edb1c9d1fd8191aFixvia CVE List
- github.com/thelia/thelia/commit/b71258902b5dd278007d0f37ddad45f76d06d5bcFixvia CVE List
- github.com/thelia/thelia/releases/tag/3.1.2Fixvia CVE List
- github.com/thelia/thelia/releases/tag/3.2.1Fixvia CVE List
- github.com/thelia/thelia/security/advisories/GHSA-5524-qfxp-33v9Advisoryvia CVE List
- vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-file-upload-rce-via-filename-trailing-spaceAdvisoryvia CVE List
- github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/File/Service/FileProcessorService.php#L119-L160Referencevia CVE List