Description

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-10-12T15:17:05.503Z",
  "pubdate": "2026-10-12T15:17:05.503Z",
  "executiveSummary": "Thelia v2.6.0 contains an arbitrary file upload vulnerability within its document update functionality. While the document upload endpoint implements strict file type validation, the update mechanism fails to enforce identical security controls, allowing for the bypass of intended restrictions.\nThe vulnerability allows an authenticated user with administrative privileges to upload arbitrary executable files, including PHP scripts, to the server. Successful exploitation results in Remote Code Execution (RCE), granting the attacker full control over the application server.\nThis vulnerability is critical due to the potential for complete system compromise, unauthorized data access, and lateral movement within the infrastructure. Exploitation requires valid administrative credentials, limiting the attack surface to malicious insiders or compromised administrator accounts.",
  "technicalDetails": "The vulnerability originates from an inconsistent implementation of input validation security controls across different API endpoints within the Thelia v2.6.0 application architecture. Specifically, the system employs a robust validation logic for the initial document upload process, which effectively filters and blocks unauthorized executable file extensions. However, the document update endpoint fails to perform identical server-side verification, creating a security regression.\nThe root cause is a failure to centralize file upload validation logic, resulting in a disparity between the security posture of the creation and modification handlers. An attacker who has obtained administrative access can leverage the document update endpoint to overwrite or replace existing file entries with malicious payloads. By manipulating the request to the document update endpoint, the attacker can submit a crafted file containing arbitrary PHP code.\nThe attack flow proceeds as follows: First, the attacker identifies a legitimate document entry within the Thelia administrative backend. Second, the attacker utilizes the document update endpoint to initiate a modification request for the target document. Third, rather than submitting an expected file type, the attacker provides a malicious script (e.g., a webshell or remote command execution script). Because the update endpoint lacks the validation present in the creation endpoint, the server processes the file upload and persists the executable file to the web-accessible directory.\nOnce the file is successfully uploaded and stored, the attacker can trigger execution by requesting the file path directly via a web browser. The server's web engine (e.g., PHP-FPM or Apache mod_php) processes the uploaded script, leading to full Remote Code Execution (RCE) in the context of the web server user. This allows the attacker to execute arbitrary system commands, interact with the application database, exfiltrate sensitive configuration files, or pivot to other systems within the internal network. The persistence of the malicious script ensures that the attacker maintains a backdoor on the server, significantly increasing the impact of the initial compromise."
}