In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. (CVE-2026-103522)

In Thelia v2.6.0, the store banner upload functionality does not properly validate uploaded file types and depends exclusively on MIME types provided by the client. This flaw enables an attacker who has administrative access to upload a PHP file disguised as an image, bypassing the validation mechanism. The uploaded PHP file can then be executed on the server, resulting in remote code execution (RCE). The vulnerability is identified as CWE-434 (Unrestricted Upload of File with Dangerous Type).

An attacker with administrative access to Thelia v2.6.0 can exploit this vulnerability to upload and execute arbitrary PHP code on the server. This leads to full compromise of the affected system, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 7.2 (high).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and avoid uploading files from untrusted sources. Monitor for suspicious file uploads and consider additional server-side validation of uploaded files beyond client-supplied MIME types.