CVE-2026-103535 Thelia CVE debrief

Who should care

Defenders of Thelia installations, particularly those with version 2.6.1, should assess exposure and prioritize remediation. This includes reviewing and updating Thelia installations, restricting UPDATE-level permissions on admin.configuration.language to trusted users, monitoring translation editor usage for suspicious activity, and implementing additional security measures to prevent path traversal and code injection. Security teams should also verify a

Why it matters

CVE-2026-103535 is a critical vulnerability in Thelia v2.6.1 that allows authenticated users to write files outside expected directories and inject executable code. Defenders should assess exposure, prioritize remediation, and restrict translation editor usage.

• Potential remote code execution with web-server privileges
• Possible unauthorized file writes outside expected directories
• Required verification of affected versions and remediation status
• Need for restricted permissions on translation editor usage

Technical summary

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor. An authenticated user with UPDATE-level permissions can write files outside the expected templates/ directory, including to web-accessible paths, and inject executable code into the translation file. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. The translation-writing logic does not escape ` in user-supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file.

Defensive priority

High

Recommended defensive actions

• Review and update Thelia installations to ensure version 2.6.1 is not in use
• Restrict UPDATE-level permissions on admin.configuration.language to trusted users
• Monitor translation editor usage for suspicious activity
• Implement additional security measures to prevent path traversal and code injection
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail page provide information on path traversal and PHP code injection vulnerabilities in Thelia v2.6.1. The vulnerabilities allow authenticated users to write files outside the expected templates/ directory, including to web-accessible paths, and inject executable code into the translation file. Defenders should verify affected versions and remediation status, and restrict translation editor usage. The information provided is based on the CVE Program and NVD records, and may not be exhaustive. Additional ver

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.