CVE-2026-103522

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...

CVE-2026-103522 CVE-2026-103522

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...

CVE-2026-103522

Thelia v2.6.0 is vulnerable to remote code execution due to insufficient filetype validation in the store banner upload feature. The system relies exclusively on client-supplied MIME types, allowing an attacker with administrative access to bypass validation by uploading a PHP file disguised as a...

EUVD-2026-97475

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...

CVE-2026-103522 CVE-2026-103522

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...

CVE-2026-103522: Unrestricted Upload of File with Dangerous Type

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...

PT-2026-110602

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description The store banner upload feature performs insufficient filetype validation by relying exclusively on client-supplied MIME types. This allows an attacker with administrative access to upload a PHP file disguised ...