CVE-2026-103522
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Oct 12, 2026
Vendor
unknown
Description
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.