8 matches found
CVE-2026-109397
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName strips the...
CVE-2026-109397
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName strips the...
EUVD-2026-97494
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName strips the...
CVE-2026-109397 Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName strips the...
CVE-2026-109397
Thelia versions before 3.1.2 and 3.2.x before 3.2.1 are vulnerable to an unrestricted file upload flaw. The FileProcessorService validates raw filenames, but FileManager::sanitizeFileName() subsequently strips trailing spaces, allowing authenticated back-office users to bypass security checks and...
CVE-2026-109397 Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName strips the...
CVE-2026-109397 Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName strips the...
PT-2026-110626
Name of the Vulnerable Software and Affected Versions Thelia versions prior to 3.1.2 Thelia versions 3.2.x prior to 3.2.1 Description Authenticated back-office users can upload PHP files by adding a trailing space to the filename. While the FileProcessorService validates the raw filename, the...