Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload… (CVE-2026-109397)

The vulnerability in Thelia before 3.1.2 and 3.2.x before 3.2.1 arises from inconsistent filename validation and sanitization. FileProcessorService validates the raw filename including a trailing space, but FileManager::sanitizeFileName() removes the trailing space before storing the file. This discrepancy allows an attacker with back-office authentication to upload PHP files with a trailing space appended to the filename, bypassing restrictions. The uploaded PHP file is stored under public/cache/documents/ and can be executed by the web server, leading to remote code execution.

Successful exploitation allows authenticated back-office users to execute arbitrary PHP code on the server with the privileges of the web server user. This can lead to full compromise of the affected system, including data theft, service disruption, or further network pivoting.

The vulnerability is fixed in Thelia versions 3.1.2 and 3.2.1. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly confirmed in the input data, but the version boundaries indicate these are the fixed releases. No vendor advisory content was provided to confirm patch availability or alternative mitigations.