CVE-2026-103535

Executive Summary

CVE-2026-103535 is a critical remote code execution vulnerability in Thelia v2.6.1, an open-source PHP e-commerce platform. The flaw chains a path traversal in the item_name parameter with improper escaping in the translation-writing logic, allowing an authenticated user with UPDATE-level permissions on admin.configuration.language to write and execute arbitrary PHP code on the web server. Successful exploitation results in full server compromise under the web-server process identity, exposing customer data, payment processing, and backend infrastructure.

Technical Analysis

Thelia v2.6.1 exposes an administrative translation editor that writes user-supplied translation values into PHP files. Two distinct defects combine into a code-execution primitive.

Defect 1 — Path traversal in item_name. The item_name parameter is used to construct the destination path for the translation file that is written to disk. The application fails to sanitize traversal sequences such as ../. Because the value flows directly into the write path, an attacker can escape the intended templates/ directory and target arbitrary locations, including directories served by the web server.

Defect 2 — PHP string-literal breakout in translation values. When the translation writer serializes user-supplied values into PHP source, it does not escape backslash (\) characters. In PHP string literals, an unescaped backslash acts as an escape character for the following byte, allowing an attacker to terminate the enclosing string literal and inject arbitrary PHP statements that execute when the file is later included or requested.

Chained: the traversal defect controls where the file is written; the escaping defect controls what is written. The result is an arbitrary PHP file placed at a web-reachable path, executed with the privileges of the web-server process. This is a classic write-what-where primitive that upgrades a low-privileged authenticated admin action into unauthenticated-equivalent RCE against the host.

The preconditions are meaningful: the attacker must already hold administrative credentials with UPDATE rights on the admin.configuration.language resource. This places exploitation firmly post-authentication, reducing the initial attack surface but sharply elevating the impact in scenarios involving insider threats, credential stuffing against weak admin accounts, and lateral movement after an initial foothold.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description. No specific code patterns, function names, or payload strings beyond those named in the description are asserted.

1. Reconnaissance and access. The attacker identifies an internet-facing Thelia v2.6.1 storefront (recognizable by its administrative panel and platform assets) and obtains administrative credentials with UPDATE permission on admin.configuration.language. This may be achieved through credential reuse, phishing, or prior compromise of an admin session.

2. Triggering the traversal. The attacker submits a translation-editor request in which the item_name parameter carries directory-traversal sequences (../) to redirect the write destination out of the expected templates/ directory and into a web-accessible location.

3. Triggering the code injection. In the same or a companion translation value, the attacker supplies input containing unescaped backslash characters designed to break out of the PHP string literal into which values are serialized, appending attacker-controlled PHP statements to the generated file.

4. Execution. The attacker requests the resulting PHP file over HTTP. The web server executes it with the privileges of its own process, yielding command execution.

5. Post-exploitation. From the initial code execution, an attacker can establish persistence, read application configuration (including database credentials and secret keys), pivot into the backend database, exfiltrate customer and order data, and move laterally across the hosting environment.

Impact Assessment

Impact is severe where exploitation succeeds. Using the unscored vector above as a structural reference: confidentiality, integrity, and availability are each rated High, because code execution permits reading of all server-accessible data, modification of application and payment logic, and destruction or ransomware deployment. Scope is Unchanged (the vulnerable component is the application and its hosting host), and privileges required are Low — reflecting the authenticated, UPDATE-scope precondition — with no user interaction.

Because Thelia is an e-commerce platform, blast radius extends beyond the host: PCI-scoped payment data, customer PII, order records, and any integrated payment gateways are all in scope. A compromised storefront can also be weaponized to serve malicious scripts to shoppers, creating downstream reputational and regulatory exposure. Affected systems are any deployment running Thelia v2.6.1 with the administrative translation editor enabled and reachable.

CISA KEV listing: NO — at time of writing there is no evidence of exploitation in the wild, no public PoC, and no Nuclei template.

Detection Guidance

Sigma Rule

title: Thelia Translation Editor Path Traversal and PHP Injection Attempt
id: 8f3a2c91-6b47-4d8e-9a15-7c2f0d5e4b3a
status: experimental
description: Detects traversal sequences or backslash injection in Thelia translation editor writes
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103535
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-query|contains:
      - 'item_name=../'
      - 'item_name=..%2f'
      - 'item_name=..%5c'
      - 'item_name=%2e%2e%2f'
  selection_editor:
    cs-uri-query|contains: 'admin.configuration.language'
  condition: selection_editor and selection_traversal
fields:
  - c-ip
  - cs-uri-query
  - cs-method
level: high
tags:
  - attack.t1190
  - cve.2026.103535

YARA Rule

rule CVE_2026_103535_Thelia_Trans_Injection
{
    meta:
        description = "Detects injected PHP in Thelia translation files via CVE-2026-103535"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103535"
        date = "2026-01-01"
    strings:
        $php_open = "<?php"
        $php_eval = "eval("
        $php_system = "system("
        $php_shell = "shell_exec("
        $php_passthru = "passthru("
        $escaped  = "\\\\'"
    condition:
        filesize < 512KB and
        $php_open and
        2 of ($php_eval, $php_system, $php_shell, $php_passthru)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103535 Thelia Translation Editor Path Traversal Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"admin.configuration.language"; http.uri; content:"item_name"; http.uri; pcre:"/item_name=[^&]*(\.\.\/|\.\.%2f|\.\.%5c)/i"; reference:cve,2026-103535; classtype:web-application-attack; sid:2026103535; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "GET" and
    url.query contains "admin.configuration.language" and
    url.query contains "item_name" ]
  [ network where url.query rlike ".*item_name=(\.\./|\.\.%2f|\.\.%5c).*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search cs_uri_query="*admin.configuration.language*" cs_uri_query="*item_name*"
| regex cs_uri_query="(?i)item_name=([^&]|%2f|%5c)*(\.\.|%2e%2e)"
| stats count min(_time) as first_seen max(_time) as last_seen by src, cs_uri_query
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="web,thelia,cve-2026-103535">
  <rule id="2026101" level="10">
    <if_sid>31100</if_sid>
    <match>admin.configuration.language</match>
    <regex>item_name=[^&]*(\.\./|\.\.%2f|\.\.%5c)</regex>
    <description>CVE-2026-103535: Thelia translation editor path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict network access to the Thelia administrative interface so that the translation editor is not reachable from untrusted networks. Enforce least privilege on the admin.configuration.language resource, removing UPDATE rights from all but a minimal set of trusted operators. Enable Web Application Firewall rules to block item_name values containing traversal sequences (../, encoded variants). Audit translation files under templates/ for unexpected PHP content or recently modified timestamps.

2. Patch/upgrade steps. No vendor fix is currently identified. Track Thelia release channels and monitor the project's advisory feed for a security release addressing CVE-2026-103535; upgrade immediately once available. Until then, treat affected instances as high-risk and compensate with the access controls above.

3. Long-term hardening. Sanitize and canonicalize all user-supplied path components before use; reject traversal sequences at the input boundary. Use strict output encoding when serializing values into source files, escaping backslashes and quotes. Isolate the web-server process with a low-privilege account and read-only mounts for static assets. Segment the storefront from backend databases and payment systems.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-103535
• Thelia project — https://thelia.net/
• CWE-22: Path Traversal — https://cwe.mitre.org/data/definitions/22.html
• CWE-94: Improper Control of Generation of Code — https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild evidence have been associated with CVE-2026-103535 at time of writing; CISA KEV does not list this CVE.