CVE WATCH / VULNERABILITY DETAIL
CVE-2026-103535
UNKNOWNCVSS 0NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-103528
- CVE-2026-103529
- CVE-2026-103521 HIGH 7.2
- CVE-2026-103522 HIGH 7.2
- CVE-2026-12613 HIGH 8.8
- CVE-2026-52903 HIGH 8.8
- CVE-2026-109187 MEDIUM 6.5
- CVE-2026-108834 MEDIUM 4.3
- CVE-2026-85499
- CVE-2026-108827 MEDIUM 4.1