Threat Intelligence Database

Thelia version 2.6.1 has an absolute path traversal vulnerability in its Smarty template handling. This flaw allows an authorized user to supply an absolute filesystem path as a template, bypassing the relative path traversal checks. As a result, Smarty loads and compiles the specified file without effective security restrictions, potentially enabling server-side template injection (SSTI) and remote code execution with the web server's privileges.

Thelia version 2.6.0 allows authenticated administrators to upload and install modules via a ZIP upload function without proper validation or sandboxing of embedded PHP code. This vulnerability enables execution of malicious PHP code included in a module's install() method during installation, resulting in remote code execution with the web server's privileges.

Thelia version 2.6.0 contains multiple stored cross-site scripting (XSS) vulnerabilities in its administrative interface. These vulnerabilities arise from insufficient output encoding or sanitization of user-supplied input, which is stored and later rendered in administrator pages and product pages. This allows arbitrary JavaScript execution when the affected pages are viewed, impacting administrative functions such as category and product creation.