CVE-2026-103535 Details

A vulnerability in Thelia version 2.6.1's translation editor allows for path traversal and PHP code injection, which can be combined to achieve remote code execution. The issue arises because the 'item_name' parameter, used to determine the write path for translation files, does not properly sanitize directory traversal sequences. This flaw enables an authenticated user with 'UPDATE' permissions on 'admin.configuration.language' to write files outside the designated 'templates/' directory, including into web-accessible areas. Additionally, the translation-writing process fails to escape backslashes in user-provided values, permitting inputs to escape PHP string literals and inject executable code into the translation files. When these vulnerabilities are exploited together, they allow a malicious PHP file to be written to a web-accessible location and executed with the privileges of the web server.