CVE-2026-109397

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109397
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109397.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109397
Aliases
  • GHSA-5524-qfxp-33v9
Published
2026-10-12T15:16:43Z
Modified
2026-10-28T02:31:08Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
Details

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-434"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109397.json"
}
References

Affected packages

Git / github.com/thelia/thelia

Affected ranges

Type
GIT
Repo
https://github.com/thelia/thelia
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d589573261ee9a41db6386375f3beb9f610c5ffd
Introduced
cdff8e3d89985d880a3605ebd6bc585780583d92
Fixed
72a72e442b7a15a54eb2991758e1066b58cfab1e
Fixed
6b706f5cb96e6b12d890c6d16edb1c9d1fd8191a
Fixed
b71258902b5dd278007d0f37ddad45f76d06d5bc
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.1.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "3.2.0"
                },
                {
                    "fixed": "3.2.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "6b706f5cb96e6b12d890c6d16edb1c9d1fd8191a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "b71258902b5dd278007d0f37ddad45f76d06d5bc"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "3.1.2",
            "range": [
                {
                    "fixed": "d589573261ee9a41db6386375f3beb9f610c5ffd"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "3.2.1",
            "range": [
                {
                    "fixed": "72a72e442b7a15a54eb2991758e1066b58cfab1e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.0-RC1
2.0.0-beta1
2.0.0-beta2
2.0.1
2.0.2
2.0.3-beta
2.0.3-beta2
2.1.0
2.1.0-alpha1
2.1.0-alpha2
2.1.0-beta1
2.1.0-beta2
2.1.1
2.2.0
2.2.0-alpha1
2.2.0-alpha2
2.2.0-beta1
2.2.0-beta2
2.2.0-beta3
2.3.0
2.3.0-alpha1
2.3.0-alpha2
2.3.0-beta1
2.3.0-beta2
2.4.0
2.4.0-alpha1
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.0-alpha1
2.5.0-alpha2
2.5.1
2.5.2
2.5.3
2.5.4
3.*
3.0.0
3.0.0-beta1
3.0.0-beta3
3.0.0-beta4
3.0.0-beta5
3.1.0
3.1.1
3.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109397.json"