CVE-2026-109397 Thelia CVE debrief

Who should care

Defenders managing Thelia installations, especially those with exposed back-office access, should assess their exposure and prioritize patching or mitigating this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security of Thelia deployments.

Why it matters

CVE-2026-109397 allows authenticated users to upload malicious PHP files, potentially leading to remote code execution. Defenders should prioritize patching, restrict back-office access, and monitor for suspicious activity.

• Potential remote code execution as the web server user
• Elevation of privileges for authenticated back-office users
• Possible data breaches or unauthorized modifications

Technical summary

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where back-office access is exposed to untrusted users or networks.

Recommended defensive actions

• Patch Thelia to version 3.1.2 or 3.2.1
• Restrict back-office access to trusted users and networks
• Monitor public/cache/documents/ for suspicious files
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the FileProcessorService validating the raw filename but FileManager::sanitizeFileName() stripping the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user. Official sources confirm this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.