VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Thelia 2.6.0 and 2.6.1 have multiple security flaws: CVE-2026-103521 and CVE-2026-103522 allow authenticated admins to upload malicious executable files due to insufficient file validation, enabling remote code execution. CVE-2026-103523 is an open redirect vulnerability in the address creation workflow. CVE-2026-103524 and CVE-2026-103527 enable stored and reflected XSS in administrative templates. CVE-2026-103526 allows unauthenticated attackers to enumerate valid admin usernames due to differing error responses and lack of rate limiting. CVE-2026-103528 allows authenticated admins to inject malicious Smarty expressions in email templates, enabling OS command execution. CVE-2026-103529 permits malicious PHP code execution during module installation. CVE-2026-103535 and CVE-2026-103537 in version 2.6.1 allow path traversal and server-side template injection leading to remote code execution. These vulnerabilities collectively allow full server compromise with web server privileges or browser-based attacks against admins. No official patch is available as coordination with Thelia was unsuccessful.

Authenticated administrative attackers can achieve full remote code execution on the server via multiple vectors including unsafe file uploads, module installation, unsafe template evaluation, and translation file injection. Stored and reflected XSS vulnerabilities enable JavaScript execution in administrative interfaces, risking session hijacking and privileged actions. Unauthenticated attackers can enumerate valid admin usernames, facilitating brute force attacks. The open redirect vulnerability can be used to redirect users to attacker-controlled sites, increasing phishing risks. Overall, these vulnerabilities expose both server-side and client-side attack surfaces, potentially leading to complete compromise of the application environment with web server privileges.

No official patch or fix is currently available for these vulnerabilities. Users and organizations should immediately restrict access to Thelia administrative interfaces to trusted personnel only. Disable or limit features such as file uploads, module installation, and template editing where possible. Monitor for suspicious administrative activity and consider additional network-level protections to limit exposure. Follow vendor advisories for updates and apply patches promptly once available.