CVE WATCH / VULNERABILITY DETAIL
CVE-2026-103521
HIGHCVSS 7.2NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as m
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-103528
- CVE-2026-103529
- CVE-2026-103535
- CVE-2026-103522 HIGH 7.2
- CVE-2026-12613 HIGH 8.8
- CVE-2026-52903 HIGH 8.8
- CVE-2026-109187 MEDIUM 6.5
- CVE-2026-108834 MEDIUM 4.3
- CVE-2026-85499
- CVE-2026-108827 MEDIUM 4.1