CERT/CC Warns of 11 Unpatched Thelia Vulnerabilities Enabling Remote Code Execution
Do Son 
TL;DR
CERT/CC published a note on October 12, 2026, listing 11 Thelia vulnerabilities in the open-source e-commerce platform. Seven of them can lead to remote code execution by an authenticated back-office user. No patch exists yet, because CERT/CC could not reach the vendor.
- Total: 11 CVEs
- Severity: 2 High · 1 Low · 8 Unrated
- Actively exploited: None confirmed
- Highest severity: 7.2 (High · CVSSv3) — CVE-2026-103521
- Action: Apply the latest security updates now
Too many alerts in your inbox? Switch to one weekly digest, sorted by severity.
Try Team free for 14 daysNotable CVEs
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-103521 | 7.2 | CWE-434 | Not exploited |
| CVE-2026-103522 | 7.2 | CWE-434 | Not exploited |
| CVE-2026-103526 | 3.7 | CWE-204 | Not exploited |
| CVE-2026-103523 | Awaiting analysis | CVE-2026-103523 | Not exploited |
| CVE-2026-103524 | Awaiting analysis | CVE-2026-103524 | Not exploited |
| CVE-2026-103527 | Awaiting analysis | CVE-2026-103527 | Not exploited |
| CVE-2026-103528 | Awaiting analysis | CVE-2026-103528 | Not exploited |
| CVE-2026-103529 | Awaiting analysis | CVE-2026-103529 | Not exploited |
Why It Matters
Thelia runs online storefronts, so a compromise can expose customer and order data. CERT/CC warns that “exploitation of any of these issues can result in complete compromise of the underlying application environment with the privileges of the web server.”
The patch gap makes things worse. In the CERT/CC vulnerability note VU#162329, the coordinator states: “Unfortunately, we were unable to coordinate these vulnerabilities with Thelia, and a patch is not yet available.”
How the Attacks Work
Remote code execution
Most of the serious bugs sit in admin features. Weak checks on file uploads and updates could let an admin place executable files on the server. Similarly, the module installer runs bundled code without review. Template and translation editors also allow code injection. As a result, a stolen admin account becomes a path to full server control.
Browser-based and account attacks
Other flaws target users rather than the server. Stored and reflected XSS bugs let attackers run scripts in an admin’s browser and hijack the session. In addition, the login page reveals which admin usernames exist. Finally, an open redirect can send shoppers to phishing sites.
In CERT/CC’s words, “Together, these vulnerabilities facilitate full server takeover for authenticated administrative attackers.”
Exploitation status
No exploitation in the wild has been confirmed. Likewise, no public proof-of-concept has been confirmed.
Affected Versions
- Thelia 2.6.0 and 2.6.1 (ten CVEs)
- Thelia 3.0.0, through a template injection flaw in the Messages feature (CVE-2026-107248)
Patch and Mitigation Steps
Since no fix exists, CERT/CC urges users to “restrict access to Thelia administrative interfaces, disable or tightly limit file-upload and template-editing features, and remove PHP execution permissions from user-writable directories.”
- Place the admin panel behind a VPN or IP allowlist.
- Enforce strong, unique admin passwords and multi-factor login where possible.
- Add rate limiting, MIME filtering and URL allowlisting at a reverse proxy.
- Watch for a vendor update to these Thelia vulnerabilities and apply it quickly.
Researchers from the ETC JSC security team reported the flaws.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
