# CVE-2026-103529: Thelia remote code execution in module installation

Source: https://junglewise.ai/threats/cve-2026-103529-thelia-v2-6-0-permits-authenticated-administrators-to-upload-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-103529 · Severity: medium · CVSS 5.4 · Published 2026-10-12

Thelia is an open-source e-commerce platform that allows merchants to manage online storefronts and product catalogs. Authenticated administrators can upload and install modules via a ZIP upload function that does not validate or sandbox embedded PHP code. An attacker with admin access can include malicious PHP code in a module's install method to achieve remote code execution with web server privileges, potentially compromising the entire store and customer data.

Technologies: [Thelia](https://junglewise.ai/threats/technologies/thelia). Vendors: [Thelia](https://junglewise.ai/threats/vendors/thelia).

## Quick answers

**Is CVE-2026-103529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103529 being exploited in the wild.

**How severe is CVE-2026-103529?** Medium severity, with a CVSS score of 5.4, published 12 October 2026.

**Which products and versions are affected?** Thelia 2.6.0.

**Is there a fix for CVE-2026-103529?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103529 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103529?** Check whether you run Thelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability exists in Thelia v2.6.0's module installation handler. The ZIP upload function fails to validate or sandbox PHP code within module install() methods, allowing authenticated administrators with module installation privileges to execute arbitrary code. The attack requires admin-level access and code execution occurs during the module installation process with web server privileges.

## Affected products

- Thelia Thelia 2.6.0

## Timeline

- 2026-10-12: disclosed

## References

- [https://kb.cert.org/vuls/id/162329](https://kb.cert.org/vuls/id/162329)

## Related threats

- [Thelia stored cross-site scripting in store media upload](https://junglewise.ai/threats/cve-2026-120248-thelia-before-3-1-1-contains-a-stored-cross-site-scripting)
- [Thelia CSRF vulnerability in back office administrative actions](https://junglewise.ai/threats/cve-2026-120206-thelia-before-3-2-0-contains-a-cross-site-request-forgery)
- [Thelia stored cross-site scripting in coupon condition summary](https://junglewise.ai/threats/cve-2026-120205-thelia-before-3-1-0-contains-a-stored-cross-site-scripting)
- [Thelia coupon usage limit bypass](https://junglewise.ai/threats/cve-2026-112285-thelia-before-3-1-5-and-3-2-x-before-3-2-4-contains-a-business)
- [Thelia unrestricted file upload via trailing space bypass](https://junglewise.ai/threats/cve-2026-109397-thelia-before-3-1-2-and-3-2-x-before-3-2-1-contains-an)