CVE-2026-109397: Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Theliato a version that resolves this vulnerability.Fixed in 3.1.2 - Upgrade
Upgrade
Theliato a version that resolves this vulnerability.Fixed in 3.2.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Thelia back-office user with the ability to upload files can exploit it. The attack can be performed remotely and does not require user interaction.
Which versions need remediation?
The affected versions are Thelia releases before 3.1.2 and 3.2.x releases before 3.2.1. Upgrading to 3.1.2 or 3.2.1, as applicable, addresses the affected version ranges.
What does successful exploitation allow?
An attacker can upload a PHP file using a filename with a trailing space so that validation accepts it but filename sanitization stores it as an executable .php file. The resulting code runs as the web server user from public/cache/documents/.
How can defenders look for possible exploitation?
Inspect public/cache/documents/ for unexpected .php files, particularly files that may have originated from uploads with trailing spaces in their names. Review back-office upload activity for suspicious authenticated users and uploaded filenames.