Thelia e-commerce platform multiple RCE flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT/CC discloses 10 unpatched Thelia 2.6.0/2.6.1 vulnerabilities enabling admin-level remote code execution, SSTI, XSS, and account enumeration; no patch available.
CERT/CC published Vulnerability Note VU#162329 detailing ten vulnerabilities in Thelia, an open-source e-commerce platform, affecting versions 2.6.0 and 2.6.1. The flaws span file upload/update validation gaps, unsafe Smarty template handling, unrestricted PHP execution during module installation, path traversal in the translation editor, stored and reflected XSS in the admin interface, an open redirect in the address workflow, and an authentication oracle allowing admin username enumeration. Several issues (CVE-2026-103521, -103522, -103528, -103529, -103535, -103537) allow an authenticated administrator to achieve full remote code execution with web server privileges, through mechanisms such as uploading disguised PHP files, abusing module ZIP installation, injecting Smarty expressions into email templates, or chaining path traversal with PHP code injection in translation files. The XSS flaws (CVE-2026-103524, CVE-2026-103527) could let attackers hijack admin sessions, while the open redirect (CVE-2026-103523) and username enumeration (CVE-2026-103526) increase the effectiveness of phishing and brute-force attacks.
All vulnerabilities require some level of administrative or authenticated access to exploit, except the username enumeration flaw which is unauthenticated. CERT/CC states it was unable to coordinate disclosure with Thelia and no patch is currently available. Researchers from ETC JSC security team (K08UK0VU, s-b321, DuanNH, Deflask13, LongNBH, and NNPhong) are credited with discovery. There is no indication of in-the-wild exploitation; this is a coordinated disclosure of previously unpatched issues.
Defenders running Thelia should treat admin accounts as high-value targets given the RCE chains require only admin access, not a separate escalation. Until a vendor patch is released, CERT/CC recommends restricting access to admin interfaces, disabling or limiting file-upload and template-editing features, removing PHP execution permissions from writable directories, and applying reverse-proxy protections (rate limiting, MIME filtering, URL allowlisting).
Mentioned in this report
Detection guidance
Web Server Process Spawning Shell With Recon or Download Commands
A PHP or web server process (php-fpm, apache, httpd, php-cgi) spawns a shell running recon or download-and-execute commands, as seen after Thelia admin-to-RCE chains (module ZIP install, Smarty injection, translation file code injection). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell With Recon or Download Commands
id: 293f513a-578b-5127-a768-d4999b0b093a
status: experimental
description: Detects a PHP or web server process spawning a shell that runs discovery
or download-and-execute commands. Covers post-exploitation after authenticated RCE
in PHP e-commerce platforms such as Thelia (malicious module install, Smarty template
injection, PHP code injected into translation files).
tags:
- attack.execution
- attack.t1059
- attack.t1190
- attack.t1505.003
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /php-fpm
- /php-cgi
- /apache2
- /httpd
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- whoami
- uname
- /etc/passwd
- 'curl '
- 'wget '
- 'nc '
- /dev/tcp/
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Legacy PHP applications that shell out to curl or wget for scheduled maintenance
- Hosting control panels that run uname from web-triggered scripts
level: high
author: Vorant
references:
- https://kb.cert.org/vuls/id/162329
Path Traversal Sequences in Admin Translation Editor Request
HTTP requests to an admin translation endpoint containing directory traversal sequences, matching the Thelia translation editor path traversal chained with PHP code injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Sequences in Admin Translation Editor Request
id: d65486c0-5ac0-51c1-8ebd-fb18ea7553f6
status: experimental
description: Detects web requests to an admin translation editor endpoint containing
traversal sequences in the URI or query string. Thelia 2.6.x translation editor
path traversal can be chained with PHP code injection into translation files for
RCE.
tags:
- attack.initial-access
- attack.t1190
- attack.t1083
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains:
- /admin/
cs-uri-stem|contains|all:
- translation
selection_traversal:
cs-uri-query|contains:
- ../
- ..%2f
- '%2e%2e%2f'
- '%2e%2e/'
- ..\
- ..%5c
condition: selection_path and selection_traversal
falsepositives:
- Vulnerability scanners run by the owner against the admin interface
- Custom translation tooling that passes relative paths in parameters
level: medium
author: Vorant
references:
- https://kb.cert.org/vuls/id/162329
Web Server Process Writing PHP File to Media or Upload Directory
A web server or PHP process creates an executable PHP-type file in a Thelia media or upload directory, indicating a disguised PHP upload/web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Writing PHP File to Media or Upload Directory
id: fbc7229e-f556-57d3-8eba-ecea59815fc5
status: experimental
description: Detects creation of PHP-executable files (php, phtml, phar) in media
or upload directories by a web server or PHP-FPM process. Thelia file upload validation
gaps allow an authenticated admin to upload disguised PHP files for RCE.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection_proc:
Image|contains:
- /php-fpm
- /php-cgi
- /apache2
- /httpd
selection_path:
TargetFilename|contains:
- /local/media/
- /upload/
- /uploads/
selection_ext:
TargetFilename|endswith:
- .php
- .phtml
- .phar
- .php5
condition: selection_proc and selection_path and selection_ext
falsepositives:
- CMS plugin or theme installers that legitimately extract PHP files into an uploads
directory
- Cache generation writing PHP files under an upload path
level: high
author: Vorant
references:
- https://kb.cert.org/vuls/id/162329
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/162329
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs