{"id":"CVE-2026-103535","revision":"46f8797c218c4281aac5cf416fcf8f41","records":[{"revision":"46f8797c218c4281aac5cf416fcf8f41","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-103535","aliases":[],"title":"CVE-2026-103535","description":"Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web‑accessible paths. Separately, the translation‑writing logic does not escape `\\` in user‑supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web‑server’s privileges.","state":0,"publishedAt":"2026-10-12T14:55:58.21+00:00","modifiedAt":"2026-10-15T17:03:58.233+00:00","affected":[{"ecosystem":"Vendor product","name":"Thelia","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Thelia\",\n                    \"product\": \"Thelia\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"2.6.1\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://kb.cert.org/vuls/id/162329"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103535","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-103535","identifiers":["CVE-2026-103535"]},"retained":false,"historicalAffected":[]}],"coverage":[]}