CVE WATCH / VULNERABILITY DETAIL
CVE-2026-103522
HIGHCVSS 7.2NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlyi
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-103528
- CVE-2026-103529
- CVE-2026-103535
- CVE-2026-103521 HIGH 7.2
- CVE-2026-12613 HIGH 8.8
- CVE-2026-52903 HIGH 8.8
- CVE-2026-109187 MEDIUM 6.5
- CVE-2026-108834 MEDIUM 4.3
- CVE-2026-85499
- CVE-2026-108827 MEDIUM 4.1