These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-103537 debrief based on CVE Program and NVD records. Thelia 2.6.1 is affected by an absolute path traversal vulnerability in its Smarty template handling, which enables Server-Side Template Injection (SSTI) and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences but does not reject absolute paths, allowing an authorized user to supply an arbitr [truncated]
CVE-2026-103535 debrief based on CVE Program and NVD records. The vulnerability is a path traversal and PHP code injection issue in Thelia v2.6.1's translation editor, allowing authenticated users with UPDATE-level permissions to write files outside expected directories and inject executable code. Defenders should assess exposure, prioritize remediation, and restrict translation editor usage. The CVE reco [truncated]
CVE-2026-103529 debrief: Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code, enabling remote code execution with the privileges of the web server. This vulnerability allows attackers to execute malicious PHP code via module uploads, highlighting the need for restricted module installation and valid [truncated]
CVE-2026-103528: Thelia 2.6.0 Smarty Email Template Injection. The vulnerability allows an authenticated administrator to inject malicious Smarty expressions into email templates, potentially leading to arbitrary OS command execution, file read/write operations, and Remote Code Execution (RCE). Defenders should assess exposure, prioritize remediation, and verify Thelia version and Smarty function restrict [truncated]
Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript. This vulnerability allows attackers to execute JavaScript code on authenticated users, potentially leading to unauthorized actions. [truncated]
CVE-2026-103526 debrief based on CVE Program and NVD records. The vulnerability in Thelia 2.6.0 allows unauthenticated attackers to enumerate valid administrator accounts due to different responses for invalid usernames and passwords, and lack of rate limiting on authentication attempts. This issue can lead to targeted attacks, as successful enumeration can aid in phishing or brute-force attacks. Defender [truncated]
CVE-2026-103524 is a stored XSS vulnerability in Thelia v2.6.0's administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including [truncated]
CVE-2026-103523 is an open redirect vulnerability in Thelia v2.6.0's address creation workflow. After accessing a crafted URL and submitting the 'Add New Address' form, the application redirects users to a URL specified in the `next` parameter without validating if the destination belongs to the same origin or an approved allowlist. This allows an attacker to supply an arbitrary external URL and redirect [truncated]
CVE-2026-103522 debrief based on CVE Program and NVD records. The vulnerability is a remote code execution issue in Thelia v2.6.0, caused by insufficient filetype validation in the store banner upload feature. This allows an attacker with administrative access to upload a PHP file disguised as an image, bypassing validation and achieving remote code execution on the underlying server. Administrators and s [truncated]
CVE-2026-103521 is a vulnerability in Thelia v2.6.0 where the document update endpoint does not validate file types, allowing an attacker with administrative permissions to upload executable files for remote code execution. This oversight in validation enables malicious actors to potentially execute arbitrary code on the server, emphasizing the need for immediate patching and verification of Thelia instal [truncated]