CERT/CC says ten Thelia 2.6 flaws are unpatched; Thelia ships 3.2.1

CERT/CC says ten Thelia 2.6 flaws are unpatched; Thelia ships 3.2.1

12 October 2026: CERT/CC has published ten CVEs in Thelia 2.6.0 and 2.6.1, the French open-source e-commerce platform, six of which give a user with back-office access a way to run code on the shop server, and says no patch is available because it could not coordinate with the maintainers. The project's own release history tells a different story: a 2.6.2 maintenance release in August, and security releases of the 3.1 and 3.2 lines on 6 October.

Not yet independently verified. Neither CERT/CC nor Thelia has said whether 2.6.2 or the 3.x releases fix these CVEs; the comparison here is ours, from what each changelog describes. Thelia has published no statement on the note. We will update this when it can be confirmed, and remove this note.

Thelia is written in PHP and uses the Smarty template engine, which is where several of the flaws sit. CERT/CC lists the vendor status as unknown, with the maintainers notified on 11 August.

The flaws CERT/CC lists

The code execution paths all start from the back office:

• CVE-2026-103521: the document update endpoint skips the executable file check that the upload endpoint applies
• CVE-2026-103522: the store banner upload trusts the MIME type the browser sends, so a PHP file can pass as an image
• CVE-2026-103528: Smarty email templates can call system(), exec() and file functions when previewed
• CVE-2026-103529: a module installed from a ZIP runs its install() code without any check
• CVE-2026-103535 (2.6.1): path traversal and PHP injection in the translation editor
• CVE-2026-103537 (2.6.1): absolute paths slip past checkTemplate(), so Smarty compiles any file on disk

The rest reach further. CVE-2026-103526 lets an attacker with no account tell valid administrator names from invalid ones, with no rate limit on the login or password reset forms. CVE-2026-103524 and CVE-2026-103527 are stored and reflected cross-site scripting in the admin screens, and CVE-2026-103523 is an open redirect through the next parameter after adding an address. Together they give a route from guessing an administrator's name, or tricking one into a link, to running code on the server.

What Thelia's own releases say

Thelia 2.6.2, released on 13 August, fixes self-redirects, enforces declared import formats on uploads and adds a check against server-side request forgery in the TinyMCE file manager. CERT/CC names only 2.6.0 and 2.6.1 as affected and does not mention 2.6.2.

The 3.x line goes further. Version 3.2.0 removes the Smarty back office from the default install, and 3.1.2 and 3.2.1 fix an upload policy bypass that stored a .php document and ran it, block HTML and script documents from being published, and neutralise formulas in CSV exports. Several of those match the shape of CERT/CC's upload flaws, but no one has mapped one list onto the other.

What a Thelia shop can do now

CERT/CC's mitigations are the baseline: restrict the admin interface to known addresses, turn off or tightly limit uploads and template editing, and remove PHP execution rights from every directory users can write to. Rate limiting at the reverse proxy covers the username enumeration. For a shop still on 2.6, moving to 2.6.2 at least picks up the August fixes; the 3.x releases are where the project now publishes security advisories.

Open-source carts in our catalogue

Our shopping cart software category lists 18 products, including the self-hosted PHP carts OpenCart, AbanteCart and Zen Cart. Thelia itself is not yet listed.

Sources

• CERT/CC: Vulnerability Note VU#162329, multiple vulnerabilities in Thelia 2.6.0 and 2.6.1, 12 October 2026
• JVN: JVNVU#99982995, Thelia vulnerabilities (Japanese), 13 October 2026
• Thelia on GitHub: release 3.2.1 and 3.1.2 notes, 6 October 2026
• Thelia on GitHub: release 2.6.2 notes, 13 August 2026