CVE-2026-109397Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

Description

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• GitHub Security Advisory (GHSA-5524-qfxp-33v9) vendor-advisory
• https://github.com/thelia/thelia/commit/6b706f5cb96e6b12d890c6d16edb1c9d1fd8191a patch
• https://github.com/thelia/thelia/commit/b71258902b5dd278007d0f37ddad45f76d06d5bc patch
• https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/File/Service/FileProcessorService.php#L119-L160 technical-description
• Thelia 3.1.2 Release Notes release-notes
• Thelia 3.2.1 Release Notes release-notes
• VulnCheck Advisory: Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space third-party-advisory