CVE WATCH / VULNERABILITY DETAIL
CVE-2026-103529
UNKNOWNCVSS 0NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-103528
- CVE-2026-103535
- CVE-2026-103521 HIGH 7.2
- CVE-2026-103522 HIGH 7.2
- CVE-2026-12613 HIGH 8.8
- CVE-2026-52903 HIGH 8.8
- CVE-2026-109187 MEDIUM 6.5
- CVE-2026-108834 MEDIUM 4.3
- CVE-2026-85499
- CVE-2026-108827 MEDIUM 4.1