No vendor patch for Thelia 2.6.0 and 2.6.1 admin paths to remote code execution, CERT/CC says
CERT/CC rates Thelia 2.6.0 and 2.6.1 critical for multiple admin-reachable paths to remote code execution. No vendor patch is available, so each shop has to limit its own exposure.
The Engineer · Build desk
Thelia 2.6.0: document, banner, email template, module flaws. 2.6.1: translation editing, absolute-path Smarty SSTI. No vendor patch. Exposed: orders, customer data, credentials, payment data. CERT/CC advises isolating the admin interface and restricting permissions.
- exposure Thelia 2.6.0 shops Document update, banner, email template and module flaws affect 2.6.0, per CERT/CC, claim 6
- exposure Thelia 2.6.1 shops Translation editing and Smarty SSTI using absolute paths affect 2.6.1, per CERT/CC, claim 6
- constraint Shop operators No vendor patch is currently available, claim 4
- exposure Customer and payment data Impacts include access to orders, customer data, credentials and payment-related data, claim 14
- decision Admin interface CERT/CC advises isolating it from the Internet behind a VPN, IP allowlist and MFA, claim 15
- decision Admin permissions CERT/CC advises restricting or disabling document, banner, module, template and translation management, claim 16
| Who | How | Kind | Claim |
|---|---|---|---|
| Thelia 2.6.0 shops | Document update, banner, email template and module flaws affect 2.6.0, per CERT/CC | exposure | 6 |
| Thelia 2.6.1 shops | Translation editing and Smarty SSTI using absolute paths affect 2.6.1, per CERT/CC | exposure | 6 |
| Shop operators | No vendor patch is currently available | constraint | 4 |
| Customer and payment data | Impacts include access to orders, customer data, credentials and payment-related data | exposure | 14 |
| Admin interface | CERT/CC advises isolating it from the Internet behind a VPN, IP allowlist and MFA | decision | 15 |
| Admin permissions | CERT/CC advises restricting or disabling document, banner, module, template and translation management | decision | 16 |
What happened
- CERT/CC ties the document, banner, email template and module flaws to 2.6.0, and translation editing and absolute-path Smarty injection to 2.6.1.
- A PHP file dropped through a document update or banner upload, or a module ZIP carrying PHP, runs with web server privileges once it is requested or installed.
- Most RCE paths need administrator or limited admin privileges, while unauthenticated attackers can enumerate usernames and start certain browser attacks.
- CERT/CC advises isolating the admin interface from the Internet behind a VPN, an IP allowlist and MFA.
Why it matters
- cost An exploited shop loses the web server account, which reaches orders, customer data, credentials and payment-related data, and the operator carries that exposure with no fixed release to apply.
- constraint Moving from 2.6.0 to 2.6.1 does not leave the advisory's scope, since both versions are listed as affected and no patched version exists to move to.
- decision Shops that delegate translation, banner, document or module permissions must decide now whether those roles stay, because each UPDATE permission is a route to code execution.
- exposure Admin-only is a weaker gate than it sounds: a hijacked admin session via XSS or a brute-forced account supplies the privilege every RCE route needs.
Each of the advisory's routes reaches code execution on its own, with its own preconditions [3]. Closing the upload route leaves the template and translation routes open.
Two routes work like this. In the translation editor, a user holding the admin.configuration.language UPDATE permission puts ../ in the item_name parameter and points the write at a web-accessible path outside the templates directory [9]. The translation value then breaks out of a PHP string literal because backslashes are escaped insufficiently. The editor writes the PHP file, and the attacker requests its URL [10].
The second route goes through checkTemplate(). An authorized user passes an absolute filesystem path, and the validation, which only blocks relative directory traversal, lets it through. Smarty then loads and compiles the file with no security policy, so template code runs with web server privileges [11]. The email-template route ends the same way: a malicious Smarty expression saved through message configuration calls functions such as system(), exec() or file_put_contents() when the template is previewed or rendered [8].
The privilege bar is lower than the word "admin" suggests. CERT/CC says most RCE paths need administrator or limited admin privileges [12]. The translation route needs one UPDATE permission on one area [9]. The advisory also lists admin session hijacking through stored or reflected XSS, plus username enumeration that makes brute force more efficient [13]. We think any account holding document, banner, module, template or translation permissions should be treated as a code-execution account until a fix ships.
Two conditions bound every route. The attacker needs admin or UPDATE-level permission on the targeted path, and the PHP file or Smarty template must be executable with web server privileges [18]. The advisory advises disabling PHP execution in user-writable directories and validating MIME types, extensions and content on the server [17]. In our view that control fits the file-drop routes best. The Smarty routes carry their payload as a template expression, not a dropped file, so network isolation and permission cuts matter more there [16].
For detection, the advisory says administrators may see admin login attempts, username enumeration, document, banner or module uploads, template or translation changes, new PHP files and web server child processes [19]. It lists no related malware or threat groups [20].
The excerpt we have is incomplete. It lists eleven CVEs but maps six to a version, leaving five unassigned [21]. Nor does it separate the paths that were reproduced from those judged only feasible. The advisory states that no vendor patch is currently available [4].
What to watch
- A Thelia release or vendor statement that fixes the eleven listed CVEs.
- CERT/CC or JVN updates that map the five unassigned CVEs to versions and attack paths.
- Reports of exploitation in the wild, and any threat group CERT/CC later ties to these flaws.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CERT/CC published an advisory titled 'Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1' on 2026-10-12 with a severity of Critical.
- [2]
The advisory lists the affected products as Thelia 2.6.0, Thelia 2.6.1 and the Smarty template engine.
- [3]
Thelia's administrative features contain multiple attack paths, including file uploads, client MIME spoofing, Smarty function execution, module installation, path traversal with PHP injection and absolute path SSTI, that allow attackers with administrative or limited privileges to achieve remote code execution on the web server.
- [4]
No vendor patch is currently available.
- [5]
The advisory lists eleven related CVEs: CVE-2026-103521, -103522, -103523, -103524, -103526, -103527, -103528, -103529, -103535, -103537 and CVE-2026-107248.
- [6]
According to CERT/CC, document updates (CVE-2026-103521), banners (CVE-2026-103522), email templates (CVE-2026-103528) and modules (CVE-2026-103529) affect version 2.6.0, while translation editing (CVE-2026-103535) and Smarty SSTI using absolute paths (CVE-2026-103537) affect version 2.6.1.
- [7]
An attacker with Thelia administrator privileges can place a PHP file in an executable path via document update or banner upload, or upload a module ZIP containing malicious PHP code, then request the file over the web or trigger module installation to execute PHP with web server privileges.
- [8]
An administrator can save a malicious Smarty expression in an email template via message configuration; when the template is previewed or rendered, unrestricted functions such as system(), exec() or file_put_contents() execute with web process privileges.
- [9]
An attacker with the admin.configuration.language UPDATE permission includes ../ in the item_name parameter to specify a web-accessible path outside the templates directory.
- [10]
The attacker injects code by breaking out of a PHP string literal because of insufficient backslash escaping in the translation value; the editor writes a malicious PHP file and the attacker executes it by requesting the URL.
- [11]
An authorized user can pass an absolute filesystem path to checkTemplate(), bypassing validation that only blocks relative directory traversal; Smarty then loads and compiles the file without security policies, executing template code with web server privileges.
- [12]
Most RCE paths require a remote attacker with Thelia administrator or limited admin privileges. Username enumeration and certain browser attacks can be initiated by unauthenticated attackers.
- [13]
Listed impacts include admin session hijacking via stored or reflected XSS, username enumeration, improved brute-force efficiency, and phishing via open redirect.
- [14]
Impacts include remote code execution and file read/write with web server privileges, and access to e-commerce applications, orders, customer data, credentials and payment-related data.
- [15]
CERT/CC advises isolating the administrative interface from the Internet and protecting it using a VPN, IP allowlist and MFA.
- [16]
CERT/CC advises restricting or disabling permissions for document, banner, module, template and translation management.
- [17]
CERT/CC advises disabling PHP execution in user-writable directories and validating MIME types, extensions and content on the server side.
- [18]
The attacker must possess the necessary admin or UPDATE-level permissions for the targeted path, and the uploaded or generated PHP or Smarty template must be executable with web server privileges.
- [19]
Administrators may observe admin login attempts, username enumeration, document, banner or module uploads, template or translation modifications, new PHP files, and web server child processes.
- [20]
The advisory lists related malware and threat groups as 'None specified'.
- [21]
Five of the eleven listed CVEs are not mapped to a version in the excerpt.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Vulnerability DisclosureFollow
- Remote Code Execution SurfacesFollow
- E-commerce securityFollow