CVE-2026-103529 — Vulnerability intelligence
Thelia — Thelia
Published:
- CVSS
- 5.4
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.