CVE-2026-109397 Details

A vulnerability allowing unrestricted file uploads has been identified in Thelia versions prior to 3.1.2 and in the 3.2.x branch prior to 3.2.1. This vulnerability allows authenticated back-office users to upload PHP files by adding a trailing space to the filename. The FileProcessorService validates the raw filename, but the FileManager's sanitizeFileName() method removes the space, resulting in the storage of an executable .php file in the public/cache/documents/ directory. Consequently, the uploaded file can be executed as the web server user.

Users can update to Thelia versions 3.1.2 or 3.2.1, both of which include the necessary fix. After updating, it is recommended to remove any files that were uploaded before the update and could still be present in the document cache.