Is CVE-2026-109397 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109397 being exploited in the wild.

How severe is CVE-2026-109397?

High severity, with a CVSS score of 7.2, published 12 October 2026.

Which products and versions are affected?

Thelia before 3.1.2 and 3.2.x before 3.2.1.

Is there a fix for CVE-2026-109397?

Yes: fixed in Thelia 3.1.2, 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109397 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109397?

Check whether you run Thelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109397: Thelia unrestricted file upload via trailing space bypass

CVE-2026-109397 · Severity: high · CVSS 7.2 · Published 2026-10-12

Thelia is an open-source e-commerce platform. Authenticated back-office users can bypass file upload restrictions by appending a trailing space to PHP filenames, allowing upload and execution of malicious code on the web server. This grants an attacker the ability to execute arbitrary commands with the privileges of the web server process.

Technologies: Thelia. Vendors: Thelia.

Quick answers

Is CVE-2026-109397 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109397 being exploited in the wild.
How severe is CVE-2026-109397?: High severity, with a CVSS score of 7.2, published 12 October 2026.
Which products and versions are affected?: Thelia before 3.1.2 and 3.2.x before 3.2.1.
Is there a fix for CVE-2026-109397?: Yes: fixed in Thelia 3.1.2, 3.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109397 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109397?: Check whether you run Thelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Thelia 3.1.2, 3.2.1

Technical details

Thelia's FileProcessorService validates filenames against a blacklist but performs the check against the raw filename provided by the client. However, FileManager::sanitizeFileName() later strips trailing spaces and special characters before storage, allowing a file named "shell.php " (with trailing space) to pass validation but be stored as executable "shell.php" in the public web-accessible directory. This is an authenticated attack requiring back-office credentials, allowing remote code execution as the web server user.

Affected products

Thelia Thelia before 3.1.2 and 3.2.x before 3.2.1

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.