What’s Vulnerable › Vulnerabilities
CVE-2026-103521: CVE-2026-103521
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-12 · updated 2026-10-13
- Weakness: CWE-434
Description
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.
Affected products
- Thelia: through 2.6.0
In the news
References
Get alerted when CVE-2026-103521 or the next vulnerability affects your stack