Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code… (CVE-2026-103535)

Thelia v2.6.1 has a path traversal vulnerability in the translation editor's item_name parameter, which lacks sanitization of directory traversal sequences like '../'. This allows writing files outside the intended templates/ directory. Additionally, the translation-writing logic fails to escape backslashes in user input, enabling PHP code injection by breaking out of string literals. When chained, these vulnerabilities allow an authenticated user with specific permissions to write and execute arbitrary PHP code on the server, achieving remote code execution.

An attacker with authenticated UPDATE-level permissions on admin.configuration.language can write arbitrary PHP files to web-accessible paths and execute them with the web server's privileges. This leads to remote code execution, potentially compromising the entire server and application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict UPDATE-level permissions on admin.configuration.language to trusted users only and monitor for suspicious activity related to the translation editor.