# CVE-2026-103522: Thelia store banner upload insufficient MIME validation

Source: https://junglewise.ai/threats/cve-2026-103522-in-thelia-v2-6-0-the-store-banner-upload-feature-performs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-103522 · Severity: high · CVSS 7.2 · Published 2026-10-12

Thelia is an open-source e-commerce platform that lets merchants manage online storefronts and product catalogs. The store banner upload feature in version 2.6.0 only validates files based on the client-supplied MIME type, which an attacker with admin access can forge to upload malicious PHP scripts. This enables an attacker to execute arbitrary code on the web server and take complete control of the e-commerce platform.

Technologies: [Thelia](https://junglewise.ai/threats/technologies/thelia). Vendors: [Thelia](https://junglewise.ai/threats/vendors/thelia).

## Quick answers

**Is CVE-2026-103522 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103522 being exploited in the wild.

**How severe is CVE-2026-103522?** High severity, with a CVSS score of 7.2, published 12 October 2026.

**Which products and versions are affected?** Thelia 2.6.0.

**Is there a fix for CVE-2026-103522?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103522 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103522?** Check whether you run Thelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-103522 affects the banner upload endpoint in Thelia v2.6.0, which performs insufficient file type validation by trusting only client-supplied MIME types without server-side verification. An authenticated administrator can upload a PHP file with a spoofed image MIME type to bypass validation and achieve remote code execution on the underlying server. This is a file upload vulnerability requiring administrative privileges and network access to the admin interface.

## Affected products

- Thelia Thelia 2.6.0

## Timeline

- 2026-10-12: disclosed

## References

- [https://kb.cert.org/vuls/id/162329](https://kb.cert.org/vuls/id/162329)

## Related threats

- [Thelia stored cross-site scripting in store media upload](https://junglewise.ai/threats/cve-2026-120248-thelia-before-3-1-1-contains-a-stored-cross-site-scripting)
- [Thelia CSRF vulnerability in back office administrative actions](https://junglewise.ai/threats/cve-2026-120206-thelia-before-3-2-0-contains-a-cross-site-request-forgery)
- [Thelia stored cross-site scripting in coupon condition summary](https://junglewise.ai/threats/cve-2026-120205-thelia-before-3-1-0-contains-a-stored-cross-site-scripting)
- [Thelia coupon usage limit bypass](https://junglewise.ai/threats/cve-2026-112285-thelia-before-3-1-5-and-3-2-x-before-3-2-4-contains-a-business)
- [Thelia unrestricted file upload via trailing space bypass](https://junglewise.ai/threats/cve-2026-109397-thelia-before-3-1-2-and-3-2-x-before-3-2-1-contains-an)