Description

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-10-12T16:17:05.233Z",
  "pubdate": "2026-10-12T16:17:05.233Z",
  "executiveSummary": "Thelia versions before 3.1.2 and 3.2.x before 3.2.1 are susceptible to an unrestricted file upload vulnerability that enables Remote Code Execution (RCE).\nThis vulnerability originates from a discrepancy between filename validation logic and the subsequent sanitization process used by the application during the file upload procedure.\nBy manipulating filenames with trailing spaces, an authenticated back-office user can bypass security checks, allowing the storage of malicious PHP files in a publicly accessible directory.\nSuccessful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the web server user.\nThe vulnerability poses a high-risk scenario for organizations, as it provides a direct vector for complete system compromise, including unauthorized access to data, configuration modifications, and lateral movement within the hosting environment.\nExploitation requires authenticated access to the back-office interface, limiting the initial vector to internal users or compromised accounts with sufficient administrative privileges.",
  "technicalDetails": "The vulnerability resides within the file processing workflow of Thelia, specifically involving the interaction between the FileProcessorService and the FileManager component.\nThe root cause is a race-condition-like logic error in the validation pipeline. When a file is uploaded, the FileProcessorService inspects the raw filename to verify its extension and security status. By appending a trailing space to the filename (e.g., 'malicious.php '), an attacker circumvents the validation logic because the check does not account for the space character during the initial evaluation.\nSubsequently, the application calls FileManager::sanitizeFileName() to prepare the file for storage. This function identifies and strips the trailing space from the filename. Because this sanitization occurs after the security validation, the resulting filename ends in the '.php' extension, which is then written to the 'public/cache/documents/' directory.\nThe attack flow follows these steps: First, the attacker authenticates to the Thelia back-office. Second, the attacker initiates a file upload request using a specifically crafted filename containing a trailing space and an embedded '.php' extension. Third, the FileProcessorService performs its validation on the raw input, which appears benign or non-executable due to the trailing space. Fourth, the FileManager::sanitizeFileName() function processes the filename, removing the space and creating a valid, executable PHP file on the server's filesystem.\nOnce the file is saved to 'public/cache/documents/', it becomes accessible via standard HTTP requests. When the attacker navigates to the URL of the uploaded file, the web server processes and executes the PHP code contained within it. This effectively provides the attacker with a web shell on the server.\nThe post-exploitation impact includes full command execution under the web server's service account, potential escalation of privileges, exfiltration of sensitive database information, and the ability to persist within the application environment. The flaw is present in Thelia versions prior to 3.1.2 and versions 3.2.x prior to 3.2.1."
}