Multiple Vulnerabilities in Thelia 2.6.0 and 2.6.1 Leading to RCE via Upload, Smarty, and Translation Editing

1. Basic Information

• Advisory Name: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1
• Publisher: CERT/CC
• Publication Date: 2026-10-12
• Source: CERT/CC
• Related Information: JVN: Multiple Vulnerabilities in Thelia
• Related Malware and Threat Groups: None specified
• Related CVEs: CVE-2026-103521, CVE-2026-103522, CVE-2026-103523, CVE-2026-103524, CVE-2026-103526, CVE-2026-103527, CVE-2026-103528, CVE-2026-103529, CVE-2026-103535, CVE-2026-103537, CVE-2026-107248
• Affected Products: Thelia 2.6.0, Thelia 2.6.1, Smarty template engine
• Severity: Critical

2. Executive Summary

The administrative features of Thelia contain multiple attack paths—including file uploads, client MIME spoofing, Smarty function execution, module installation, path traversal with PHP injection, and absolute path SSTI—that allow attackers with administrative or limited privileges to achieve remote code execution (RCE) on the web server. No vendor patch is currently available.

3. Attack Flow

The following attack and exploitation paths are identified in public disclosures, distinguishing between observed facts, reproduced experiments, and feasibility.

RCE via File Upload and Module Installation

1. An attacker obtains Thelia administrator privileges.
2. The attacker places a PHP file in an executable path via document update or banner upload, or uploads a module ZIP containing malicious PHP code.
3. The attacker requests the file over the web or triggers module installation to execute PHP code with web server privileges.

Command Execution via Smarty Email Template

1. An administrator saves a malicious Smarty expression in an email template via message configuration.
2. The template is previewed or rendered.
3. Unrestricted functions such as system(), exec(), or file_put_contents() execute with web process privileges.

Path Traversal and PHP Injection in the Translation Editor

1. An attacker with the admin.configuration.language UPDATE permission includes ../ in the item_name parameter to specify a web-accessible path outside the templates directory.
2. The attacker injects code by breaking out of a PHP string literal due to insufficient backslash escaping in the translation value.
3. The editor writes a malicious PHP file, and the attacker executes it by requesting the URL.

Absolute Path SSTI

1. An authorized user passes an absolute filesystem path to checkTemplate().
2. The input bypasses validation that only blocks relative directory traversal.
3. Smarty loads and compiles the specified file without security policies, executing template code with web server privileges.

4. Attacker Positioning and Execution Location

• Most RCE paths require a remote attacker with Thelia administrator or limited admin privileges. Username enumeration and certain browser attacks can be initiated by unauthenticated attackers.

5. Perspectives of Victims and Administrators

• Users: May experience open redirect, stored XSS on product pages, phishing, or session hijacking.
• Administrators: May observe admin login attempts, username enumeration, document, banner, or module uploads, template or translation modifications, new PHP files, and web server child processes.

6. Success and Failure Conditions

Success Conditions

• According to CERT/CC, document updates (CVE-2026-103521), banners (CVE-2026-103522), email templates (CVE-2026-103528), and modules (CVE-2026-103529) affect version 2.6.0, while translation editing (CVE-2026-103535) and Smarty SSTI using absolute paths (CVE-2026-103537) affect version 2.6.1. Verify the specific version and required privileges for each CVE.
• The attacker must possess the necessary admin or UPDATE-level permissions for the targeted path.
• The uploaded or generated PHP or Smarty template must be executable with web server privileges.

Failure Conditions and Mitigation

• Isolate the administrative interface from the Internet and protect it using a VPN, IP allowlist, and MFA.
• Restrict or disable permissions for document, banner, module, template, and translation management.
• Disable PHP execution in user-writable directories and validate MIME types, extensions, and content on the server side.

7. What Happens Upon Success

• Remote code execution and file read/write with web server privileges.
• Access to e-commerce applications, orders, customer data, credentials, and payment-related data.
• Admin session hijacking via stored or reflected XSS.
• Username enumeration, brute-force efficiency improvements, and phishing via open redirect.

8. Observable Logs

The following items are candidates for investigation within your organization, distinguishing between facts observed in public sources and telemetry that should be verified internally.

• Email: Check for email template modifications, preview or rendering events, unusual system commands, and suspicious emails originating from Thelia.
• Proxy / SWG / DNS: Check for admin login or password reset enumeration, document updates, banner uploads, module ZIPs, template and translation endpoints, and new PHP URLs.
• Endpoint / EDR: Check for modified PHP files in web roots and user-writable directories, web server child processes, compiled Smarty templates, module installation files, and translation file modifications.
• Identity / IdP: Check for admin username enumeration, login failures, session reuse, MFA events, and role or permission changes.
• SaaS / Cloud: Check hosting control panels, object storage, database audits, secret access, and deployment changes.
• Network: Check for C2 communications originating from the web server, payload downloads, internal scanning, and database exports.

9. Determining Attack Success

Confirmed in Public Information

CERT/CC has disclosed multiple vulnerabilities and their prerequisites. The reviewed advisories contain no reports of active exploitation or attack attempts in the wild.

Internal Determination Criteria

• Criteria: Correlate requests targeting vulnerable paths with unauthorized PHP or command execution under web server privileges. Do not assume execution was successful based solely on upload or edit requests.
• Correlate requests, responses, processes, authentication events, data access, and outbound transmissions chronologically to distinguish between contact and successful exploitation.
• Do not conclude that an attack succeeded based solely on a single alert not supported by public information.

10. Investigation Playbook

• Starting Point of Investigation: Focus on Thelia 2.6.0/2.6.1 exposure, anomalous administrative operations, new PHP files, and web server child processes.
• Initial Verification: Confirm software versions, admin interface exposure scope, accounts and roles, patch status, and audit upload, template, module, and translation activities.
• Endpoint and Server Investigation: Preserve web roots, upload directories, modules, templates, translations, Smarty caches, processes, cron jobs, services, and database configurations.
• Authentication and Cloud Investigation: Verify admin logins, sessions, MFA events, role changes, hosting control panels, and the use of database or cloud credentials.
• Subsequent Actions: Track webshells, commands, credential theft, customer and order data access, payment redirection, and external data exfiltration.
• Containment: Isolate the admin interface, disable risky features, quarantine unknown PHP files or modules, revoke sessions, rotate credentials, and rebuild from trusted backups.
• Classification: Distinguish between username enumeration, administrative access, browser XSS, file and template writes, code execution, data access, and subsequent compromises.

11. Defense and Detection Ideas

• Single Events: Detect PHP uploads by non-administrators or unusual accounts, dangerous Smarty functions, path traversal (../) or absolute paths in item_name parameters, and module installations.
• Chronological Correlation: Correlate username enumeration -> admin login -> upload/template modification -> new PHP requests -> web server child processes.
• Threat Hunting: Search for Thelia 2.6.0/2.6.1 installations, web-accessible PHP files, recent modules, compiled Smarty files, translation path escapes, and stored XSS payloads.
• Log Limitations: If application audit logs do not capture file contents or template expressions, supplement monitoring with file integrity monitoring (FIM) and web server process telemetry.
• Priority Mitigations: Restrict public access to admin interfaces, enforce MFA, minimize enabled features, disable PHP execution, implement WAF rate limiting, monitor file integrity, and track vendor patches.

12. Facts, Inference, and Hypothesis

Facts

• Thelia 2.6.0 and 2.6.1 contain multiple vulnerabilities in file management, Smarty templates, module installation, and administrative workflows.
• CVE-2026-103521 stems from insufficient validation in the document update endpoint, and CVE-2026-103522 stems from banner uploads that trust client-supplied MIME types, allowing administrators to place PHP files and achieve RCE.
• CVE-2026-103528 fails to restrict dangerous PHP functions in email templates, allowing administrators to execute system(), exec(), and file read/write operations.
• CVE-2026-103529 does not validate or sandbox PHP within module ZIP files and executes the install() method with web server privileges.
• CVE-2026-103535 chains path traversal in the translation editor's item_name parameter with insufficient backslash escaping for PHP injection, allowing users with UPDATE-level permissions to write web-accessible PHP files.
• CVE-2026-103537 allows Smarty SSTI and RCE via checkTemplate(), which rejects only relative traversals while permitting absolute paths.
• CVE-2026-103524 and CVE-2026-103527 involve stored and reflected XSS, CVE-2026-103526 involves admin username enumeration without rate limiting, and CVE-2026-103523 is an open redirect vulnerability.
• CERT/CC did not successfully coordinate with Thelia, and no patches are available at the time of publication.
• No active exploitation or public PoCs have been reported in the advisory.

Inference

• Multiple admin-only RCE vectors make it easier for attackers who acquire administrative sessions via phishing, credential stuffing, or stored XSS to take over the server.
• Disabling a single feature leaves other upload, template, module, and translation paths open; therefore, administrative interfaces must be network-isolated while simultaneously prohibiting PHP execution.

Hypothesis

No additional hypotheses. Unverified items are listed in "Unresolved Questions and Further Investigation".

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Abuse of Thelia's upload, template, translation, and module features to achieve web server code execution.
T1059.004	Command and Scripting Interpreter: Unix Shell	medium	system() and exec() can be invoked from Smarty templates.
T1505.003	Server Software Component: Web Shell	medium	PHP file uploads and injections allow placing web-accessible code.

14. Unresolved Questions and Further Investigation

• Technical details and impact of CVE-2026-107248.
• The timeline for vendor patches and fixed versions.
• The number of Thelia deployments, internet exposure, and the existence of active exploitation or public PoCs.

15. Impact on SOCs and Organizations

Organizations operating e-commerce platforms should verify whether they use Thelia 2.6.0 or 2.6.1. Until patches are available, restrict administrative interfaces to VPNs or IP allowlists. Disable or minimize document, banner, module, template, and translation editing features, prohibit PHP execution in user-writable directories, and audit existing PHP files and administrative sessions.

16. Summary by Role

• For SOC Teams: Correlate admin logins and XSS with subsequent upload, template, module, and translation modifications, followed by PHP or command execution. Hunt separately for each attack vector.
• For Administrators: Restrict public access to administrative interfaces, limit risky features, prohibit PHP execution in user-writable directories, and continuously monitor for vendor patches.
• For Users: Be aware of suspicious redirects or unexpected login prompts, and follow password change instructions if guided by site administrators.