Description

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-10-12T15:17:05.690Z",
  "pubdate": "2026-10-12T15:17:05.690Z",
  "executiveSummary": "Thelia v2.6.0 contains a critical unrestricted file upload vulnerability within the store banner upload functionality. The flaw originates from a reliance on client-side provided MIME types to validate file integrity, failing to perform server-side content inspection or extension verification.\nThis vulnerability allows an authenticated administrative user to bypass security controls and upload malicious PHP scripts to the web server. Successful exploitation results in Remote Code Execution (RCE), granting the attacker the ability to execute arbitrary commands, access sensitive data, or compromise the integrity and availability of the underlying server infrastructure.\nThe risk is categorized as high, as it grants full control over the application environment once the administrative interface is accessed. Mitigation requires transitioning from client-supplied metadata validation to robust server-side content verification and restricted directory execution policies.",
  "technicalDetails": "The vulnerability exists in Thelia v2.6.0 within the store banner management module. The application's file upload mechanism is designed to handle image uploads for storefront branding; however, the security logic responsible for validating uploaded files is fundamentally flawed.\nThe root cause is the reliance on the 'Content-Type' header provided by the HTTP request, which is easily manipulated by an attacker using proxy tools (such as Burp Suite) to intercept and modify the request before it reaches the server. Because the application logic trusts this client-supplied metadata instead of performing intrinsic file validation (such as checking magic bytes or file headers), it fails to detect when a malicious script is masquerading as a legitimate image format (e.g., JPEG or PNG).\nThe attack flow proceeds as follows: First, the attacker, authenticated as an administrator, initiates an upload request through the store banner management interface. Second, the attacker uploads a file with a .php extension or a file containing PHP code, while concurrently modifying the HTTP request headers to specify an image MIME type (e.g., 'image/jpeg'). Third, the server accepts the file as valid because it does not verify the actual file structure or rename the file extension to a safe format. Finally, once the file is stored in an accessible web directory, the attacker navigates to the file URL, triggering the web server to interpret and execute the embedded PHP instructions.\nThis exploitation technique leads to arbitrary code execution within the context of the web server process. Post-exploitation impact includes full system compromise, persistent backdoor installation, unauthorized access to the application's configuration files and database credentials, and the potential for lateral movement within the network segment. Because the file system path of the uploaded file is predictable or discoverable via the application interface, the payload execution is straightforward."
}